How is the server-side flow supposed to be for Facebook Apps? What I mean is, on every page load, do I have to get an access token?
Currently, in my application_controller, I have a before filter that basically
redirect_to #fb_auth.client.web_server.authorize_url (authorizes the app)
#fb_auth.client.web_server.get_access_token (gets the access token)
This seems really slow to have to get another access_token from Facebook on every page load. How is this normally done? The problem that I'm having is that to access the /me object you have to get an access token, which requires me to get the access token on every page load.
You shouldn't need to get a new access token on every page load. The access token should be good for many page loads as it takes over an hour to expire (expiration info is available when you get the token).
Also you don't have to redirect every time. On POSTs to your app (such as when the user clicks over to your app) a signed_request is included with the post data. If the user has not authorized your app, that's the time to redirect to the fb_auth. If the user has previously authorized your app, an access_token should be in the signed_request.
More info here:
http://developers.facebook.com/docs/samples/canvas/
there is a sample skeleton application available # https://github.com/michaelbaldry/fb_graph_canvas
access_token is gained when a person first visits the canvas url on apps.facebook.com/appname/ once this has happened the access_token is stored in a table and used until the next time the user comes straight to the canvas url.
Related
I'm writing an offline application that uses the Dropbox API. When a user comes to the application, I'm using the https://api.dropbox.com/oauth2/token (docs) to get a refresh_token, which I store for later use.
I am calling the same endpoint every time the user logs in (unless I've already got the user's data in a cookie). I'm not sure that this is the best way to go about it: I at least need to get the user's account_id, so that I can look up their refresh_token in the database if I already have it. But every time I call https://api.dropbox.com/oauth2/token, the user is redirected to the Dropbox app authorization interface, as if they've never approved the app before.
So I would either like to know how to stop Dropbox from forcing the user to re-authorize an app every time. Or, if that is just how https://api.dropbox.com/oauth2/token is supposed to work, I'd instead like to be able to get their account_id somehow when they visit my page.
(In case it's relevant, the app is still in development mode at this point.)
The https://api.dropbox.com/oauth2/token endpoint is an OAuth endpoint that the app can call to get an access token/refresh token. Being an API endpoint, it does not itself redirect the user to the Dropbox app authorization page.
The Dropbox app authorization page is at https://www.dropbox.com/oauth2/authorize (documented here), and the app decides if/when to direct the user there to authorize the app.
You generally only need to send the user through the app authorization flow (sending them to https://www.dropbox.com/oauth2/authorize and then calling https://api.dropbox.com/oauth2/token) once per user for an "offline" application. Once you do so, you should store the resulting refresh token for that user. You'll typically store the refresh token for that user tied to their user account in your own app.
Exactly how you manage the user accounts in your own app will depend on how it's built, but, as it sounds like this is a web app, typically you would use the user's browser cookies to identify the user when they return to your page so that you can look them up in your database and retrieve their details, such as their corresponding refresh token. (Or, if they're not already signed in to your web app, you would have them do so first.)
Greg's answer is very helpful, and very politely addresses my misunderstanding of the auth flow. (I was revisiting old code I'd written years previously—obviously I should have documented it better than I had!)
In the end I believe that Dropbox was forcing me to reauthorize because my application was in development mode, and had a small user base. When I used the identical code in an app set to production mode, it stopped forcing me to reauthorize. So the “problem” is really a Dropbox security feature, and the solution was just to use production mode.
I am trying to determine if page access tokens used with the messenger api are permanent. Seeing this code in one of their examples, which indicates to me that they are using the token as a constant value :
access_token: PAGE_ACCESS_TOKEN
I get the Page Access Token shown on my facebook app dashboard in this way:
I log into facebook, go to developer.facebook.com, select my messenger app, then on the dashboard go to Products > Messenger > Settings and can select my page and then get a token.
Can I put that value in a properties file and then use it indefinitely with my application when getting/sending messages to and from the page?
I am getting a bit confused regarding the documentation around other tokens, like user tokens and login tokens vs. page tokens.
Editing to add that I am using the page access token in order to make a POST request to this url : https://graph.facebook.com/v2.6/me/messages in order to reply to a message sent to my page by a user.
I believe I have solved this and wanted to post in case anyone else had the same confusion.
I assumed I needed to make a GET request to a facebook url in my code to get a new token before each Request to GET or POST to the messenger API. Using the information in the links above, I learned how to get an extended token here:
https://developers.facebook.com/tools/explorer/<my app id here>?method=GET&path=me%2Faccounts&version=v2.10
I then can use that ID indefinitely as it is supposed to not expire. I am going to assume it is OK to put this id into my properties file, if anyone has opinions on a better place to store this token value I would be interested.
Extended Page Tokens are valid forever.
You need to use a User Token, extend the User Token and then get an Extended Page Token with the Extended User Token.
More information:
https://developers.facebook.com/docs/facebook-login/access-tokens/
http://www.devils-heaven.com/facebook-access-tokens/
I created a linkedIn application to get company page updates and post them on a webpage.
Every time I visit the page I have to log in to linkedIn (Oauth2) to get the feed.
Is it possible to remove the log in part so that when anyone visits the page they will see the update feed?
Well the LinkedIn access token lasts 60 days so you could store the oauth 2 access token e.g. database and just use that so you don't need to login every time.
*Apologies in advance for the long background but I think it is necessary and helpful to other devs once this is answered.
Background
I am building a very social web-application in which there are several events that trigger social actions such as updating the user's Twitter status.
Currently, I use a library called "TweetMoaSharp" (.NET) to handle the Oauth workflows and events that trigger a status update or follow action work brilliantly as long as the user is briefly redirected to the Twitter authentication page.
To clarify, the user is not asked to re-authorize my app each time, but there is an unsightly flicker that lasts for 1-2 seconds while the user is directed to Twitter and then back to my app. This will annoy the end user as there are frequent Twitter interactions.
So--to relieve the situation, I use TweetMoaSharp to obtain an OAuth Access Token via the server and then store that token along with the user id returned from Twitter in my database. I then set a cookie on the client that contains the user's Twitter Id so that for future requests I can simply pass that ID to the server, grab the OAuth token form the database and do my business. No redirect required!
Problem Solved, Right?
Well, no. Stupidly, I overlooked the fact that this can cause a collision with multiple Twitter Accounts being used on the same page and ended up tweeting test-tweets to a second twitter account I own because I had changed Twitter sessions. This could happen to any user(s) who access multiple Twitter accounts from the same browser; a husband and wife for example.
Back to the Drawing Board
I thought to myself, "The Facebook JavaScript API" makes it super easy to get the id of the currently logged in user without going through a bunch of server-side token steps so I am sure Twitter offers the same approach." Ha! I haven't found one yet.
Bottom Line / Question
How do I get the ID of the currently authenticated Twitter user without redirecting them to Twitter (even for just a second)? If I can do this, then I can compare the returned ID to the one in my cookie and know if it is valid for my application's current session or if I need to have that (new) user authenticate as well so that I avoid "Tweeting" under the wrong account.
Thanks in advance.
Use your app tokens to do a verify credentials call
https://api.twitter.com/1.1/account/verify_credentials.json
The returned info is the logged in user.
Unfortunately limited to 15 calls per 15 minute window!
I'm currently implementing an Oauth consumer service which is going to use Soundcloud as an Oauth service provider as well. But I'm having the following issue with it: Taking Facebook or Twitter example, you go there, you sign in, you fill up the permission form, and you are redirected back to your app. If you go there a second time, and given you are already sign in, you basically skip all steps and are redirected back instantly. That means, Facebook recognized that you already gave permission to that 3rd party service, so it doesn't ask your permission constantly.
And that's what's happening when I use Soundcloud. Basically everytime I redirected the user to the Soundcloud Oauth connect endpoint, the permission form always shows up, even though I already gave permission to that 3rd party service previously. I'm forced to press "connect" every single time, which is a drag from the user perspective (how many times can you give permission to the same entity). My question is: is there a parameter I can use to make soundcloud recognize/validate the previous permission from the user account to that specific 3rd party service? Or is this Soundcloud Oauth design implementation and we have to live with it?
Edit:
Maybe this wasn't clear, but each time I press "connect" in soundcloud, a new access token is being generated and delivered. Since my app uses this access token to identify its users, it doesn't work very well for me that the access token is getting updated everytime I want to log in, making me effectively "sign up" everytime. To sum it up, I want to get the previously attributed token to my account, so I can look up in my database, identify it and log him in.
I'm also looking for a solution which doesn't involve storing state in the client that might get cleaned up.
What you can do is store the user's oauth token in local storage and reuse it in future sessions. That's what happens on soundcloud.com.
A longer explanation:
When you use the Connect flow, the user is authenticated by SoundCloud (either by using username/password, Facebook Connect, or an already-existing session on soundcloud.com), and then when it is successful, your app is given an oauth token for that user. This is passed to the callback page which is registered for your app.
That token is the only piece of information needed to have the user be "logged in". Unless the token expires (by time, or by the user manually revoking it), then you can reuse that in future sessions.
I think I'm a bit confused about your application's design: where and how is the oauth token being used? I think that instead of using the token as an identifier, perhaps the user's permalink might be better? If you have the oauth token, you can find out the permalink by querying api.soundcloud.com/me.