Question

I have an app in a page tab that uses the facebook javascript sdk. When a new user comes to the app, I get the expected “Log in with facebook” pop-up. I also have some extended permissions that I’ve put in the scope parameter of FB.Login. After the users logs in with facebook I see the expected extended permissions pop-up. The only problem is if the user skips the extended permissions, the dialogue returns back an access_token, but it’s not valid for the extended permissions. Code example below.

window.fbAsyncInit = function () {
    FB.Canvas.setAutoGrow();
    FB.init({
        appId: facebookAppId, 
        status: true, // check login status
    });

    function updateFBInfo(response) {
        console.log('updateResp:');
        if (response.authResponse) {
            //user is already logged in and connected
            FB.api('/me', function (info) {
                displayUserInfo(info, response);
            });
        }
        else {
            FB.login(function (loginResponse) {
                if (loginResponse.authResponse) {
                    FB.api('/me', function (info) {
                        displayUserInfo(info, loginResponse);
                    });
                }
            }, { scope: 'email,manage_pages,offline_access,publish_stream' });
        }
    }

    FB.getLoginStatus(updateFBInfo);
};

I guess my question is either, what am I missing (this has got to be something easy), or is there a way to check and see if the returned acces_token is actually valid?

Answer 1

You need to check explicitly for the permission before proceeding. If they haven’t provided the necessarily permissions, you need to display FB.login() with the necessary scope again.

Here is the code for checking permissions:

FB.api('/me/permissions', function (response) {
            var perms = response.data[0];
            // Check for publish_stream permission in this case....
            if (perms.publish_stream) {                
                // User has permission
            } else {                
                // User DOESN'T have permission. Perhaps ask for them again with FB.login?
            }                                            
    } );