Facebook App Login: How to control expiration date of an image URL I got?

Question

I'm developing an app, which uses the facebook login. After login the user must set additional informations and a profile picture, with the picture being provided from that logged in facebook account as well. Now the whole account details, including the URL to that profile picture, are saved in my database.

To my surprise the profile picture has suddenly stopped working. Opening it's URL in a browser gives me this message "URL signature expired"

https://scontent.xx.fbcdn.net/hphotos-xpa1/v/t1.0-9/p720x720/10846350_10204966809307370_2779189783437306470_n.jpg?oh=245bbada6c23f280a1e531e724be85ed&oe=56894D69

Downloading those photos and save them to my own server is not really an option for me. Is there anything I can do to make that URL durable?

Answer 1

Yes, Facebook’s CDN URLs may expire - you are not supposed to store them for long-term use.

But you can request any user’s profile picture (as long as you have their global/app-scoped user id), by simply referring to

https://graph.facebook.com/4/picture // Mark Zuckerberg’s profile pic 

– that URL issues a redirect to the current CDN URL for the image.

That image is rather small though, 50px x 50px – you can use https://graph.facebook.com/4/picture?type=large to request a larger version. That will give you the profile image in 200px x 200px (or close to that, if the user did not upload a square image.)

Note that some pictures require an access token to be retrieved. For example https://graph.facebook.com/72256131540/picture returns a generic image of a questionmark unless you add an access token like this:

https://graph.facebook.com/72256131540/picture?access_token=<ACCESS_TOKEN> 

UPDATE:

This should still work the same without problems, if you are requesting the profile picture via an app-scoped user ID. If you are requesting it via an old, global user ID or a page-scoped user id, then you will have to include an access token now - https://developers.facebook.com/docs/graph-api/reference/user/picture#requirements has the details.

(App or page access tokens should not be exposed in public client-side code, so when using those, the request should be made only server-side.)