Create facebook object each and every time? - php

Question

I have a login page which will log a user into my webapp based on their facebook login details.
I then create a session to remember who they are.
What I want to know is, should I be creating and/or checking the facebook credential on every single page of my webapp, or should I simply use the session I create at the beginning to login?
For example, once they have logged in, I would like to allow them to post a message onto their own facebook wall from my app. Should I check the login credentials before they can post by recreating the facebook object, or should I simply use the stored login details already in my session and use that to post to their facebook wall?
UPDATE:
So basically, should I be using the following code as a template each and every time I want to do something facebook related, like post to their wall, login etc etc?
<?php
session_start();
# The facebook library
require_once("facebook.php");
# Create facebook object
$config = array();
$config['appId'] = 'appId goes here';
$config['secret'] = 'secret goes here';
$config['fileUpload'] = false; // optional
$facebook = new Facebook($config);
# Check if user has active facebook session
$user_id = $facebook->getUser();
if ($user_id) {
try {
// do something here
} catch (FacebookApiException $e) {
error_log($e);
$user_id = null;
exit;
}
} else {
$loginUrl = $facebook->getLoginUrl();
header("Location: ".$loginUrl);
}
?>

Answer 1

I’d check the user in every request, just in case you have brittle code that may allow a user to create sessions themselves.

Answer 2

I'd check the user on every request. If you want to make a post via the facebook api, you will need to have a valid facebook access_token. If you check on every page (combined with the js SDK) then the user will be signed back into your site again, rather than you getting an access token error and having to ask them to sign in again