Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


Facebook and other sites have features where they ask users for their credentials for 3rd party web sites (see image below). Presumably, facebook then uses the credentials to login as the user and harvest their email contacts to match against facebook's user database.


Does anyone know that kind of permission is required from a 3rd party website to login on behalf of one of their users? Or is no permission required?

I suppose it is analogous to giving an apartment key to your pet sitter. The only thing that would stop the pet sitter from entering your apartment is if the complex's TOS explicitly state that no one may unlock the door of an apartment that they do not own. But would those TOS apply to the pet sitter? Or would they only apply to renters who enter into a service agreement with the complex?

enter image description here

share|improve this question
It is done through an API, it isn't like you actually collect their login info... – Josh Mountain Apr 4 '13 at 19:55
Some of the 3rd parties may have an API open to Facebook, but the screenshot clearly shows a prompt asking the user for his Email Password. – Walter Stabosz Apr 4 '13 at 22:50
up vote 0 down vote accepted

Relaying credentials in this manner is purely a matter of trust. Notice the text "Facebook won't store your password." - the user has to take their word for that, as anything transmitted to the server could easily be stored by it. However, this statement in itself could be taken as TOS, since it is an explicit promise to the user.

The TOS of the service to which authentication is relayed will tell you whether it is allowed. Most (free) services have no restrictions on third parties authenticating on your behalf, nor require any special permissions. It is generally up to the user to decide what to do with their account information. Some services (e.g. Google) give more control over these decisions with features like two-factor authentication and application-specific passwords.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.