Question

I’m trying to create a server side access to a user’s Facebook resources (photos/albums/etc).
I want that the user will authenticate once using its native mobile application, and that the server will be able to access user’s data without the user interaction.

I’m trying to understand the steps I need to take in order to make it work.

I’ve read Facebook’s: Login for Server-side Apps but I can’t understand how to use the scenario proposed in there – because my server has nothing to do with user interaction (I cannot redirect the user to some login dialog) – the server is performing its own operation in the background whether the user is using its mobile application or not. What should I do upon token expiration for example?

More then that, I want that the user will be able to perform direct Facebook operation on the mobile itself, without the server intervention.

As I see it, this is the flow I would expect:

1. User’s launches a native mobile application.
2. The user authenticates using Facebook’s SDK on the native mobile app.
3. The user received a special token, that can be converted at server side to an access-token.
4. The token will be sent to the server and stored there.
5. If the server needs to access user’s Facebook data, it uses this special token and converts it to an access token.
6. When the token expires – the server can extend it, using the special token, without any user interaction.

What data should be sent to the server from the mobile application after authentication. And how should the server use this data to access user’s Facebook resources anytime?

I’m using the C# Facebook SDK for the server. But I think it is not that important, I need to understand the mechanics.

Answer 1

Tokens expire if the user does not continue to use the application. This is by design–an application should not continue to access the user’s account if the user stops using the application.

When a user logs into your application, a token is given to your application, along with an expiration date for that token. You can use that token from your client or your server until it expires. However, there is nothing your server can do to extend the token if the user does not continue to use your application.

If the user continues to use your application, you will have an opportunity to update your server token. For example, in the Android and iOS SDKs, tokens are automatically refreshed if the user uses your application to make a facebook request. At that time, you can transmit the refreshed token to your server.