When adding Facebook integration to a web app, how do you handle OAuth token expiration and what user data should be saved? -
i'm planning out adding facebook integration web app i'm working on. part, it's proceeding smoothly, confused on proper way handle oauth token.
the sequence of events presented facebook here is:
- ask user authorize application, sends them facebook window.
- this return authorization code generated facebook
- you hit https://graph.facebook.com/oauth/access_token authorization code, give time-limited oauth token.
- using oauth token, can make requests access user's facebook profile.
facebook's documentation has following token expiration:
in addition access token (the access_token parameter), response contains number of seconds until token expires (the expires parameter). once token expires, need re-run steps above generate new code , access_token, although if user has authorized app, not prompted again. if app needs access token infinite expiry time (perhaps take actions on user's behalf after not using app), can request offline_access permission.
when re-run steps above, steps need re-run new oauth token? what data (facebook uid, authorization code, oauth token) make sense save local database?
i able have user continue interact site, , in response user actions, able prompt user if want post facebook wall.
the access token time , session based , unnecessary data store , have no use after user have closed session. facebook uid thing need identify user. since facebook api horrible slow store username aswell.
but identification, need uid.
Comments
Post a Comment