Have offline_access tokens started expiring on logout? - facebook-graph-api

Question

I have a number of PHP scripts that pull data from my Facebook profile.
I had set these up with an Access Token that I took from the Graph Explorer.
https://developers.facebook.com/tools/explorer/
I ensured that when generating the tokens, I asked for the offline_access extended permission.
These scripts worked fine for months, but over the last few days, I notice that whenever I logout of Facebook, the token becomes invalidated, and I have to log back in each time and get a new one.
My understanding was the an offline_access token survives a logout, but not a password change.
Has something changed in this regard?

Answer 1

I've done some more research on this.
FB are deprecating the offline_access permission. That means it will no longer be possible to obtain an access token that gives your app open-ended permission to query a user's data.
Instead, your app will have to test the validity of any existing token, and it that token has expired, you will be able to swap it for a new one. Previously, if you had an expired token, you had to send your user through the auth process again to get a new one, so this is actually a positive development.
See: https://developers.facebook.com/docs/offline-access-deprecation/
In my own particular example, where I was using a token obtained from the Graph Explorer in a PHP script that queried the Graph with cURL (ie independently of a user session on FB), I can't however do this.
The Graph Explorer is an app in its own right, and it seems that in the last few days it has switched on the deprecate_offline_access migration in its settings, which means existing offline_access tokens obtained via Graph Explorer will now expire on logout.
Also, I can't issue a request in my script to swap the token, as this requires the APP SECRET for the Graph Explorer app, which I don't have.
Therefore, existing offline_access tokens obtained as part of the standard auth process should continue to work, but offline_access tokens obtained via the Graph Explorer will not.
This effectively means that it is no longer possible to script interaction with the Graph where Extended Permissions are required. All such interaction will now have to occur within a user session.
I can see the logic in this, but its a bit of a spanner in the works for cron jobs etc.

Answer 2

I might suspect that with the change-over (while Facebook code is written to handle both old and new ways) that there might have been a bug introduces. If you can reproduce this issue, then it should be filed as a defect with Facebook at http://developers.facebook.com/bugs.
I've checked using a basic access token with a brand new app. I only asked for offline permissions. I checked the token in the linter and it says it was ok. I logged out of facebook then back in. Then rechecked the token. And sure enough it was invalidated. In my app settings I have deprecate offline_access set to Enabled.
For my next test, I set it to disabled and checked again. Sure enough Facebook invalidated that token.
For my next test, I checked with an app created a few years ago. It has the deprecate offline_access turned off. And sure enough it was able to keep the offine access token current and did not invalidate it at all.
I also tested with an app I created during last year's F8 conference, and it also behaved correctly (not invaliding the offline token) when I logged out of facebook.
So, I guess it might depend upon how long ago your app was created.