I am using oauth.io to handle authentication in an Android app. I login using the service and then pass the access token to the server. As part of the server-side verification, I make a call to https://graph.facebook.com/debug_token?input_token={user access token}&access_token={app token}. I was receiving a response with the error message "(#100) The App_id in the input_token did not match the Viewing App".
I took this to mean that the app that generated the access token was not the same as the app that owns the app token I was sending in the request. Upon further inspection, I noticed that when I debugged the token with Facebook's tool (https://developers.facebook.com/tools/debug/accesstoken) I was seeing a different app id that belonged to oauth.io itself instead of my app. Since the app token is based on the app id and app secret, it obviously would not be correct if it was expecting oauth.io's app token.
Is there any way to continue using the debug_token endpoint through Facebook with a token generated by oauth.io?
Sorry this is a bit late - but it may still help you :) I had the same issue. In my perl code, I just did:
use LWP::Simple;
my $check_session_first = LWP::Simple::get("https://graph.facebook.com/me?access_token=$in->{token}");
if (!$check_session_first) {
print $IN->header;
print Links::SiteHTML::display('error', { error => qq|Sorry, we couldn't log you in. |});
return;
}
Basically, if $check_session_first is empty, then it means the session isn't valid. If its valid, it'll return a JSON object (which in my case, I process using the "JSON" perl module)
Related
I've made a simple website for my personal usage using flask where I can post something to my facebook page. There is a textarea where I write text and then submit it. Then the server process the text and post it on that page using graph api and access token. It works well on my system. But when I deploy this project on live server the access token expired. If I put the token on access token debugger it says facebook removed access to the token duo session change.
I search about this on google (my bestfriend ;) but found nothing. I want to post on my page without expiring token while changing server. Or is there any alternative way to post on page?
Edit:
Here is the code I'm trying to post with...
import requests
from urllib.parse import quote_plus
acc_tk='EAA....MY_PAGE_ACCESS_TOKEN'
def post_fb(message):
resp=requests.post(f"https://graph.facebook.com/v15.0/113023048137080/feed?message={quote_plus(message)}&access_token={acc_tk}")
if resp.status_code==200:
return True
else:
return False
When I create a new page access token and run this function, it returns true and the post is published on the page. But if I deploy this to live server the access token expires and then this function doesn't work any more even on local machine. If I debug this token this warning shows up~
After 1 day of debugging, I realized that the token get expired when I store token in a variable (like I showed in the question) and push it on github and then deploy it to render.com. So I managed to store token in my database and retrieve it when needed. And that's it! My code is working now.
But one thing I didn't understand that why my token get expired if I push it to github and deploy it on render.com... I found no reason about this.
This page claims that you can access the Places Graph functionality without having a logged-in user:
You make your calls using a Client Token (from the client), and an App Access Token (from the server).
The documentation regarding Client Tokens says:
The client token is an identifier that you can embed into native mobile binaries or desktop apps to identify your app. The client token isn't meant to be a secret identifier because it's embedded in apps.
This sounds like exactly what I want--I am trying to build a website that allows users to search for Facebook places. I need to be able to build the list using an AJAX request from the client side.
I can't for the life of me find any documentation on using the Client Token to make such a request.
Please note that I cannot use an App Token because this will be deployed to a website, and Facebook specifically says not to use App Tokens in that context.
I've tried using the Client Token directly as the access_token, but then I get Invalid OAuth access token.
How can I use the Client Token to make a Places Graph API call directly to Facebook's API from the client's browser?
Note: I realize that I could send the request to my own server, then relay that request from my server to Facebook, but that is not an optimal solution for me.
In case anyone is still struggling with this like I was. You just need to use the appId and client token joined with a pipe. So "appId|clientToken".
I am hoping to work on a REST API that would interface with a mobile client. I am think of implementing the following flow and hope you guys can set me off in the right direction:
User accesses the mobile app and then will signup with facebook (app)
Once the user successfully authenticates himself, the generated token is passed to the server (via an API endpoint)
The server will accept this token and will attempt to query the facebook server using this token and process the returned information
Is this possible? And am I heading in the right direction ?
Not only this is possible, but this is the approach which Facebook recommends. This is called "token debugging" in FB parlance.
The token will need to be checked and validated by your server, by calling the token debug Facebook api.
If you don't validate the token on the server, your app could be subject to various attacks, e.g. another developer could use a token generated on another app to gain entry.
The correct approach is:
testing that the user is the one to whom the token belongs to
that your app is the same for which the token was generated
that the token itself is valid.
You can manually inspect a token, in order to test your code with an online tool: https://developers.facebook.com/tools/debug/
How can I setup PAW to work with Facebook locally for development? Or even at all for that matter?
I have a node.js backend that I'm setting up with Facebook Auth. Every one of my routes needs the user to be logged in. I have two endpoints related to FB Auth. localhost:3000/api/v1/loginFB and localhost:3000/api/v1/callbackFB. Both of these work great in a web browser.
loginFB simply returns this string... https://www.facebook.com/dialog/oauth?client_id=523534457345&redirect_uri=https://localhost:3000/api/v1/callbackFB&scope=email,public_profile,user_friends.
When I call that URI in a browser, it returns a code=blahblah which my callbackFB endpoint uses to fire off another request to get the access token. All good.
So now in PAW I'm confused by the difference between the request URI and the Authorization URL text field? Should I use the loginFB URI for my request URI? And then https://www.facebook.com/dialog/oauth in the Authorization URL textfield?
Basically what's happening is that when I click Get Access Token, it returns the code but my callbackFB endpoint 500's by saying "This authorization code has been used." The code that it's getting returned is definitely different each time I Get Access Token.
This is where I'm at with this thing (Client ID and Client Secret are actually my App ID and App Secret from fb's dev management site, and the Access Token URL is actually set to https://graph.facebook.com/v2.3/oauth/access_token which I'm 99% sure is the correct URI):
This is the error I get when I click Get Access Token button:
It would be awesome to get some advice from anyone with experience with this issue. Thanks.
Re: #MichaMazaheri
tl;dr Fixed in version 2.2.2
Sorry for the super late follow-up. We actually fix this exact issue in Paw 2.2.2, which is already released on our website, and pending review for the Mac App Store. (It was some JSON vs. Form URL-Encoded parsing issue). Thanks for reporting.
I'm building a web application and I'm using OAuth to provide Facebook authentication. I've successfully generated an access_token and each time the user logs out/back in, I match their access_token to find their account. This works very well.
In addition, I'm building a Windows Phone 7 companion app. I've got the same process for authentication, using the Facebook SDK, but the access_token that is returned is different. This means I cannot match the account.
Since the logout/login to my web application appears to generate the same access_token repeatedly, I'm confused as to why the mobile app generates a different access token.
Can anyone tell me if the behaviour I'm expecting is correct? I've scoured the Facebook documentation, but can't find anything relevant. Maybe OAuth isn't the correct thing to do here.
Each time I logged in, the code would return a different access_code value. I needed to add a new field called "response_type" with a value of "code". This then redirected me to the login page and responded with the correct token, which I then exchanged for an access code.
To generate the URL, this was the code:
Facebook.FacebookOAuthClient client = new Facebook.FacebookOAuthClient();
client.AppId = "285539721457932";
client.AppSecret = "65233641cf71e6fa9fef5ecd7d802ebf";
client.RedirectUri = new Uri("http://www.imaybelate.com/Account/FacebookCallback");
url = client.GetLoginUrl(new Dictionary<string, object>()
{
{ "display", "wap" },
{ "response_type", "code" },
{ "permissions","offline_access"}
}).ToString();