I had made a Facebook APP for authorization of users on my Website, I am using OAuth Method. In My Site i have kept a Feature called "Login in With Facebook", when user clicks he gets redirected to Facebook with link
https://www.facebook.com/v2.2/dialog/oauth?client_id=<ID>&redirect_uri=<mysite>&state=<some random hash>&scope=
This looks fine enough, Now Facebook asks for Allow and when Users clicks allow, I get a URL Back on my site with a Special parameter called &code= .. It looks like
http://mywebsite.com/facebook&code=<some huge Random code>&state=<hash>
Now, i would like to know what exactly is code= parameter value says, is it the access Token of the User because i don't see special parameters like access_token=. So can somebody tell me what is code means in OAuth and is it same as Access token. ?? How can i verify it.. Please input your thoughts
Your app needs to exchange that code server-side for an access_token
There's specific documentation for this flow but essentially you take the code, your app ID, app secret, and the redirect_uri you used when opening the dialog initially, and make an API call to exchange the code for an access token
You then use the access token to make API calls on behalf of the user
Related
Facebook provides some documentation on the parameters of oauth login.
Login Dialog OAuth 2
Parameters are:
client_id = Your App ID
redirect_uri = Your App Website URL
display = page, popup, iframe, async, touch. How to display login.
scope = permission names. Permissions your app is asking the user to grant to your app.
state = a string included in the response back to your app.
response_type = code or token or both. Used in different ways depending on authorization flow.
Is there more information about different types of oauth functionality and the parameters that go with it?
I want information on how to structure the URL for oauth. I know of a couple of configurations. For example:
https://www.facebook.com/dialog/oauth?
client_id=YourAppID
&redirect_uri=The URL that you designated in your App Settings for your App
&response_type=token //Whether you want a `code` returned, or a `token` returned, or both
&scope=publish_stream // scope prompts the user for the type of permissions being asked for
I saw a discussion that showed this:
https://graph.facebook.com/oauth/authorize?
client_id=123456789
&redirect_uri=http://example.com/
&scope=publish_stream,share_item,offline_access,manage_pages
Note the difference's of the URL's:
/dialog/oauth?
or
/oauth/authorize?
What does authorize do? Does it GRANT permissions instead of ASKING for permissions? Where is the documentation on this?
https://graph.facebook.com/oauth/authorize is also to logging in the person -- Like authenticating a person and to take permission from person whether to access the requested permissions by app.
oauth/authorize is graph api call.
I think major difference may be when you want to build the login flow manually you should use /oauth/authorize.. else if you are using javascript/Apps api provided by facbook it uses /dialog/oauth. Apps normally need to confirm that the response from the Login dialog was made from the same person who started it. If you're using Facebook's JavaScript SDK it automatically performs these checks so nothing is required, assuming that you're only making calls from the browser. More over we can make graph api calls secure by applying appsecret_proof.
I have created an App on facebook and I am using this app to authorize an user via dotnetopenauth.
Here I would pass APPID and APPSECRET and get the token which would be used to call Facebook Graph to get facebook user details.
If I'm doing this for the first time, user would be asked to enter username/passowrd on the Facebook website and then the session is created in the browser and it will redirect to my website as a Facebook user. This means that if I open a new tab in the current window and open facebook, user will see his/her page directly without asking for username/password. - this is obvious and understandable.
// code
request = WebRequest.Create("https://graph.facebook.com/me?access_token=" + Uri.EscapeDataString(strAccessToken));
response = request.GetResponse();
My query is:
After the scenario above, if user logs out from Facebook website OR I close the browser window, the facebook session is lost. However, I still have the access token (string in the above code) that I got while authenticating.
So, As of this moment I am not storing any user information from Facebook (not even cookies or anything else). I am just requesting user to authorize my application as a Facebook user. When user does that, I get the access token which I can use it to make calls to Graph and REST APIs. This access token usually remains same, so I really dont need to pass the applicaition id and secret to get the token next time onwards. Actually I can request the graph APIs and REST APIs with the stored token and request user details. I have tested this and works fine.
What I am looking for is, if user opens www.facebook.com, user should see his/her personal facebook page which obviosuly is possible only if I have a session in the current browser. Hence, my question was: how do I use my access token OR what call should I make with my access token so that I can set the browser session for the facebook user? Is it possible technically?
Regards,
AG
No. Your access token is used by your web server to call facebook. It's impossible (and undesirable) for this to impact the user's browser in a way that would set a facebook.com cookie so that the user would be implicitly logged into Facebook by your use of the access token.
I have an app with a login screen with a button that invites users to login using facebook.
That authentication part of the integration works fine. I have also parsed the returned cookie variable to obtain the userID. The next step is to obtain the users information.
I found this stackoverflow article Difficulty parsing string with Facebook one click sign on and ColdFusion which says
Once you get parsed signed_request (stored in your cookie) you can use
user_id (which is Facebook User Id) and oauth_token (aka access_token)
to get needed info via Graph API or FQL.
But, how do you obtain the access_token the poster speaks of? It is not in the cookie variable (that I can see anyway).
Sorry for being such a noob. I got twitter working easy. Facebook is a pain.
https://developers.facebook.com/docs/authentication/ is your friend. Read the server side flow section.
"If the user presses Allow, your app is authorized. The OAuth Dialog will redirect (via HTTP 302) the user's browser to the URL you passed in the redirect_uri parameter with an authorization code:
http://YOUR_URL?code=A_CODE_GENERATED_BY_SERVER
With this code in hand, you can proceed to the next step, app authentication, to gain the access token you need to make API calls.
In order to authenticate your app, you must pass the authorization code and your app secret to the Graph API token endpoint - along with the exact same redirect_uri used above - at https://graph.facebook.com/oauth/access_token. The app secret is available from the Developer App and should not be shared with anyone or embedded in any code that you will distribute (you should use the client-side flow for these scenarios).
https://graph.facebook.com/oauth/access_token?
client_id=YOUR_APP_ID&redirect_uri=YOUR_URL&
client_secret=YOUR_APP_SECRET&code=THE_CODE_FROM_ABOVE
If your app is successfully authenticated and the authorization code from the user is valid, the authorization server will return the access token:
In addition to the access token (the access_token parameter), the response contains the number of seconds until the token expires (the expires parameter). Once the token expires, you will need to re-run the steps above to generate a new code and access_token, although if the user has already authorized your app, they will not be prompted to do so again. If your app needs an access token with an infinite expiry time (perhaps to take actions on the user's behalf after they are not using your app), you can request the offline_access permission."
This is regarding Facebook apps. After the user clicks on Allow button on the authorization page (OAuth page) then the user is redirected to the app with a code param in the query string. According to FB doc we should use the value of this param to get the access code needed for FB API calls.
I use FB's PHP-SDK. After the user is redirected from OAuth page then I call $facebook->getUserAccessToke() to get the access token. This code seems to fetch the access token directly from the signed_rquest (present in the cookie). It never needs to use code param. I don't understand why code param is sent then?
depends on your app settings, currently its working without the code, but you will have to migrate to the now standard oauth2.0 process.
see https://github.com/facebook/php-sdk/blob/master/examples/example.php for how to login users.
in short words, you dont have to take care of the token or code parameter, the SDK handles it itself. (via $_REQUEST array)
The authorization section of this page developers.facebook.com / docs / api contains a good description on how to perform authentication for a user agains my Facebook app. However, in my scenario I cannot get it to work the way I want. Here is how it is supposed to work:
User comes to my login page and clicks a "Sign in with Facebook" link.
User gets redirected to graph.facebook.com / oauth /authorize?[some params] and authorizes my Facebook app to access his/her data. Facebook redirects back to my site.
My site checks the Code parameter, calls Facebook to replace it for an access token, and then lets the user connect his/her account on my site with the account on Facebook. The access token is saved on the user account on my site.
The next time user arrives at my site and want to login, he/she should be able to click the same "Sign in with Facebook" link and directly get signed in with the site account (assuming he/she is still logged into Facebook)
Problem: Each time the code (from graph.facebook.com / oauth/authorize) is replaced for an access token, the token is changed. Since that token is used to look up the user in my site database, the matching failes.
My question is now: How do I solve this problem? Can the Code parameter from graph.facebook.com /oauth/authorize be saved and used over and over again to look up user? Or is there another way to do this? I really would prefer NOT using the Javascript API since it gives me lots of other troubles.
[Sorry about the links, I am a new user and not allowed to post more than one link]
Ah, I solved it: After I got the access_token I just call graph.facebook.com/me to get the id of the user. This is saved to my database. Next time I match against that id.