Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Facebook access token server-side validation for iPhone app

I'm developing iPhone application, that is based on communication with server, and I want to use Facebook authentication mechanisms.

Basically, I think it should work like this:

  1. In my iPhone app, user logs in to Facebook, using his email and password.
  2. User allows access to his data for related Facebook application.
  3. My iPhone app receives access token, after successful log in.
  4. In further communication with my server, my iPhone application should use the received Facebook access token (for example: in queries).
  5. When my server receives some query from iPhone app, with access token, it should ask Facebook that this token is valid (and for who), and if yes, server should assume that user is authenticated with Facebook.

My question is: how the server should ask Facebook if given access token is valid? I think I should somehow check if the token is valid for my Facebook app.

I've tried many Facebook queries to graph API, that I've found, but nothing worked as I expected. Can you provide me some example?

like image 670
Marcin Avatar asked Mar 23 '11 14:03

Marcin


People also ask

How do I verify my Facebook access token?

You can simply request https://graph.facebook.com/me?access_token=xxxxxxxxxxxxxxxxx if you get an error, the token is invalid. If you get a JSON object with an id property then it is valid. Unfortunately this will only tell you if your token is valid, not if it came from your app.

How do I get a short live access token on Facebook?

Go to https://developers.facebook.com/tools/explorer/ and select your app from the first drop down menu, in the left. Click on the button "Get access token", and in the "Select Permissions" window, click in "Extended Permissions" and check manage_pages and publish_stream, and click in "Get Access Token" blue button.


1 Answers

Here's a two step process you can use to validate that a user access token belongs to your App:

1) Generate an App Access token

(https://developers.facebook.com/docs/howtos/login/login-as-app/)

https://graph.facebook.com/oauth/access_token? client_id=YOUR_APP_ID &client_secret=YOUR_APP_SECRET &grant_type=client_credentials 

2) Debug the User Access token

(https://developers.facebook.com/docs/howtos/login/debugging-access-tokens/)

https://graph.facebook.com/debug_token? input_token=INPUT_TOKEN &access_token=ACCESS_TOKEN 

Where INPUT_TOKEN is the user access token you want to verify, and ACCESS_TOKEN is your app's token that you got from step 1.

The debug endpoint basically dumps all information about a token, so it'll respond with something like this:

{     data: {         app_id: YOUR_APP_ID,         is_valid: true,         metadata: {             sso: "iphone-safari"         },         application: YOUR_APP_NAMESPACE,         user_id: USER_ID,         issued_at: 1366236791,         expires_at: 1371420791,         scopes: [ ]     } } 

If that token isn't from "your app" then it will return an error response.

like image 105
sebastian the crab Avatar answered Oct 16 '22 13:10

sebastian the crab