Reposted/rephrased from http://forum.civicrm.org/index.php/topic,36059.30.html.

I am currently working on an extension to log in a user in CiviCRM using Facebook.

The user is sent to facebook for auth request/permissions, and if successful redirected to a callback page where it receives a code which is valid for one login. Now the server gets all the details to this page and create a contact and save it.

I am thinking of now sending back the user to the earlier page with the contact id and the checksum. Something which is described in the following link: https://aghstrategies.com/content/how-create-one-click-personalized-links-civicrm-emails

Now I need to keep track of if someone is logged in, is there anything I can store this constraint into or I need something, or should I directly use SESSION and store it there?


2 Answers 2


CRM_Contact_BAO_Contact_Utils::generateChecksum($contactId) is the function used to generate checksums.

Ideally your extension would call this via a corresponding API method, but I don't think one exists yet?

There's corresponding code (see validChecksum etc below that) which is used in some CiviCRM pages to identify a request with a checksum parameter.

Simple code to identify a checksum and persist against the contact is the following -

if ($cs = CRM_Utils_Request::retrieve('cs', 'String' , $this, false)) {
  if ($id = CRM_Utils_Request::retrieve('cid', 'Positive', $this, false, $userID)) {
    if (CRM_Contact_BAO_Contact_Utils::validChecksum($id, $cs)) {
      $session->set('userID', $id) ;

If they are landing on your callback already, then you can just dispense with using the checksum parameter and set the session directly before redirecting them to the page they authenticated to use.


CRM_Contact_BAO_Contact_Utils::validChecksum is the method used to validate a checksum in the url. You can see how it's used in a 3rd party module in this example from webform_civicrm:

if (!empty($_GET["cs$c"]) && CRM_Contact_BAO_Contact_Utils::validChecksum($cid, $_GET["cs$c"])) {
  $filters['check_permissions'] = FALSE;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.