oauth - How do you renew an expired Facebook access token? -
oauth - How do you renew an expired Facebook access token? -
i working this reference, , trying implement oauth protocol allow users log site via facebook. however, facebook's documentation pretty terrible , unclear in few key parts.
it says authorization takes 3 steps:
user authentication (redirect user https://facebook.com/dialog/oauth?client_id=...&redirect_uri=..., , expect redirect_uri page called code). works great!
app authorization (handled facebook, etc). works great!
app authentication (on callback page, grab code , phone call https://graph.facebook.com/oauth/access_token?client_id=...&redirect_uri=...&client_secret=...&code=.... body of response include access_token need stuff)
i understand access_token, can phone call apis , such. but, happens when expires? new one, point many http requests later, , no longer have code used in first place. have store code along side access_token? or, have tell user log in 1 time again new code new access_token?
or, missing key part here? don't need offline_access token, polling info in response user actions .
when access_token expires, user seen "logged out" facebook. app go through same process first time, user may not.
if user hasn't revoked access app, , user logged facebook @ time, app authorization process take care of itself, no actions required user, , receive new access_token.
if user hasn't revoked access app, isn't logged facebook, presented facebook login @ app authorization step. won't asked give app permission again, facebook knows app id authorized user.
finally, if user has revoked access, presented original request app authorization, , you'll follow original flow.
essentially, should consider access_token volatile, , not bother storing it, using access_token receive part of user login process, happening behind scenes time, , involving user when log out of facebook or revoke access application.
this different twitter's oauth can store , re-use it.
facebook oauth
Comments
Post a Comment