Invalidating a facebook access token?

Question

Is it possible to invalidate a facebook access token?

I need to do this due to the recent deprecation of offline_access.

The problem is that the token cannot be extended beyond 60 days. Even if the user returns to the app (unless I am misunderstanding?)

So, what I want to do is invalidate the token, then immediately log the user back in so that I can get a new access token back, with a new 60 day expiry date. As long as the user comes by once every two months, everything should be OK.

I do not want to log the user out of Facebook so FB.logout is not usable.

Is that possible?

Answer 1

You can send a DELETE request to /me/permissions which should (I think) invalidate the session for the user.

However, I don't really see why you want to do that. You can just use the server side authentication which ends up with a 60 days token regardless of what token you had before. So, every time you want 60 more days just authenticate the user using the server side process.

Answer 2

I would seriously consider avoiding the Facebook Javascript SDK like the plague as it is asynchronous which in reality means Facebook is secure but your website is not.

I've just begun to rebuild my login flow and I am wondering if this part of my code may come in handy for managing user tokens:

if ($user) {
  try {
    // Proceed knowing you have a logged in user who's authenticated.
    $user_profile = $facebook->api('/me');
  } catch (FacebookApiException $e) {
    $fb_error = $e->getResult();
    error_log($e);
    $user = null;
  }
}


//https://developers.facebook.com/docs/reference/api/errors/
switch ($fb_error['error']['error_subcode']) {
    case '458':
    //Returned on app trying something or user attempting an action after app deauth
    //Can do database cleannup operations from this
        $fb_error = '458 - User removed the app from user settings';
        break;
    case '460':
    //App is no longer reauthorized and the user is trying something ?
    //Stop user from all activities if this comes up as they may deauth then try perform an action
        $fb_error = '460 - User needs to reauthorize';
        break;
    case '463':
    //Expired Token
    //This is where we autolog the user back in
        $fb_error = '463 - Token has expired and a new one needs to be requested';
        //need to somehow get the login request code from another page to hide it
        //or use htaccess tricks
        $facebook->getAccessToken();
        break;
    case '467':
    //Invalid Token
    //This is where we autolog the user back in
        $fb_error = '467 - Token is invalid and a new one needs to be requested';
        break;
}

You could output the errors to the page for testing:

echo 'Error Subcode: '.$fb_error.'<br/>';
echo 'Facebook Error Dump:<br/>';
var_dump($e);

Note that PHP switch works like a single if statement with multiple answers (case).

I would recommend for code speed optimization reordering the switch to have the most common errors listed at the top of the switch as the way PHP switch works is to run down the list until it finds a case match to the error code.