Question

A session token is given to the user when he starts running a facebook application, as long as this token is not stolen, other people cannot impersonate him. To increase security, a new token is also generated again when it has expired or has been cleared.

So what is the problem here? Why do people want infinite session token in facebook?
How is it useful to both developers and end-users of facebook applications?

Answer 1

It’s now called “offline_access”. You’re right in that most applications don’t need this permission; however, occasionally an app may want to do some processing on behalf of the user while the user isn’t present. For example, there are some blogging apps like posterous.com that allow you to email your blog posts – and they may want to publish without asking each time. For those, it’s appropriate to ask for the extended perm.

Here’s more information about how to request the permission:
https://developers.facebook.com/docs/guides/policy/examples_and_explanations/Extended_Permissions/