oauth - How do you renew an expired Facebook access token? -
oauth - How do you renew an expired Facebook access token? -
i working this reference, , trying implement oauth protocol allow users log site via facebook. however, facebook's documentation pretty terrible , unclear in few key parts.
it says authorization takes 3 steps:
user authentication (redirect user https://facebook.com/dialog/oauth?client_id=...&redirect_uri=...
, , expect redirect_uri
page called code
). works great!
app authorization (handled facebook, etc). works great!
app authentication (on callback page, grab code
, phone call https://graph.facebook.com/oauth/access_token?client_id=...&redirect_uri=...&client_secret=...&code=...
. body of response include access_token
need stuff)
i understand access_token
, can phone call apis , such. but, happens when expires? new one, point many http requests later, , no longer have code
used in first place. have store code
along side access_token
? or, have tell user log in 1 time again new code
new access_token
?
or, missing key part here? don't need offline_access
token, polling info in response user actions .
when access_token
expires, user seen "logged out" facebook. app go through same process first time, user may not.
if user hasn't revoked access app, , user logged facebook @ time, app authorization process take care of itself, no actions required user, , receive new access_token
.
if user hasn't revoked access app, isn't logged facebook, presented facebook login @ app authorization step. won't asked give app permission again, facebook knows app id authorized user.
finally, if user has revoked access, presented original request app authorization, , you'll follow original flow.
essentially, should consider access_token
volatile, , not bother storing it, using access_token
receive part of user login process, happening behind scenes time, , involving user when log out of facebook or revoke access application.
this different twitter's oauth can store , re-use it.
facebook oauth
Comments
Post a Comment