Question

I am working from this reference, and trying to implement the OAuth protocol to allow users to log into my site via Facebook. However, Facebook’s documentation is pretty terrible and it unclear in a few key parts.

It says that authorization takes three steps:

1. User authentication (redirect the user to https://facebook.com/dialog/oauth?client_id=...&redirect_uri=..., and expect the redirect_uri page to be called back with a code). Works great!

2. App authorization (handled by Facebook, etc). Works great!

3. App authentication (On the callback page, grab the code you get and call https://graph.facebook.com/oauth/access_token?client_id=...&redirect_uri=...&client_secret=...&code=.... The body of the response will include an access_token we need to do stuff)

I understand that with the access_token, I can call the APIs and such. But, what happens when it expires? I could get a new one, but by this point it will be many HTTP requests later, and I no longer have the code I used to get it in the first place. Do I have to store the code along side the access_token? Or, do I have to tell the user to log in again so I get a new code to get a new access_token?

Or, am I missing a key part here? I don’t need an offline_access token, as I will only be polling data in response to user actions .

Answer 1

When the access_token expires, the user will be seen as “logged out” by Facebook. Your app will go through the same process as the first time, but the user may not.

If the user hasn’t revoked access to your app, and the user is logged into Facebook at the time, the App Authorization process will take care of itself, with no actions required by the user, and you will receive a new access_token.

If the user hasn’t revoked access to your app, but isn’t logged into Facebook, they will be presented with a Facebook login at the App Authorization step. They won’t be asked to give your app permission again, as Facebook knows that your app id is authorized by that user.

Finally, if the user has revoked access, then they will be presented with the original request for App Authorization, and you’ll follow the original flow.

Essentially, you should consider the access_token as volatile, and not bother storing it, but using the access_token you receive as part of the user login process, which is happening behind the scenes all the time, and only involving the user when they log out of Facebook or revoke access to your application.

This is different than Twitter’s OAuth with which you can store and re-use it.