Re-authentication

We're aware of the re-authentication feature, but it's not something we have any plans of implementing. The problem is that once a user has authenticated on your site using Facebook, they have a real Joomla account. If there is something malicious going on, the user can simply change the Joomla user email and password and login to that account directly. Re-authenticating on Facebook wouldn't really have any effect since the user would still be logged into the underlying Joomla account.

In other words, what should happen if the re-authentication fails? If the user is on a checkout page in a shopping cart and logged into Joomla via Facebook, but can't re-authenticate, do we:
* Log the user out of Joomla (if so, they can just log back in using Joomla and not their FB account)
* Block the account (this could be problematic if it's a genuine mistake)
* ???

Feel free to throw suggestions out, but it's something we've never had requested and, as above, can't really see a good use for or way to implement.

Thanks,
Alex

I'm not sure how it could be made to work with JFBConnect in a way that makes sense. Like I mentioned, since the user has a Joomla account as well as their Facebook login ability, if they can't re-authenticate through Facebook, what should the course of action be since they could just log back in with their Joomla account.

I think re-authentication works when you have a site that *only* allows Facebook users to login or register. Joomla just isn't that type of system, and the underpinnings of Joomla itself don't have any idea of a 'possibly non trusted user'. That means that any extensions that would use that functionality would need it specifically coded for that app and it wouldn't be a normal extension of Joomla.

So, I don't really see a way to make this work in a realistic fashion that actually performs some usefulness as I don't know what the degradation state (if they fail authentication) would be, or how that state would help protect anything. If you have ideas or suggestions, I'm all for listening!

Thanks,
Alex