In terms of privacy, is it acceptable to extract the user id from a Facebook share response to make use of that user's details? - facebook

Using the Facebook API, you can get back the post ID of a Facebook share, even if the user has not authorized your app.
The post ID is prefixed by your user ID, and separated by an underscore.
FB.ui({
method: 'feed',
name: 'People Argue Just to Win',
link: 'http://www.nytimes.com/2011/...',
}, function( response ){
// Response gives you :
// { post_id: "[fbUserId]_346759642059572" }
});
To me it looks like Facebook is using this programmatically, rather than with the idea of providing us the userId out of the kindness of their hearts. But it's extremely tempting to use.
I'm a little rusty on permissions - if there is a way to get back all the users that have liked/shared a specific URL, and not just a count, then this should be okay.
But the question remains, is it acceptable to use?
EDIT:
Now that I think about it, you can access the user ID by making an anonymous call to https://graph.facebook.com/[postId] but ONLY if the post was made public.

If you get a response from FB, it means that you have already ask the user for the required permissions,
so yes you can use the data returned from Facebook as you like, but you always have to inform the users how you use those data.

You can only cache user data if you have permission or it is necessary for the function of your app. Using the like button you can subscribe to edge.create and cache the response from the like.
refer to: http://developers.facebook.com/docs/reference/javascript/FB.Event.subscribe/
II. Storing and Using Data You Receive From Us
You will only request the data you need to operate your application.
You may cache data you receive through use of the Facebook API in
order to improve your application’s user experience, but you should
try to keep the data up to date. This permission does not give you any
rights to such data.
in my app i store the id of every page or user that is viewed to speed up page load times and count page views. Seems with in the scope of Policy as long as i am not sharing the info with 3rd parties or making public what a user has set to non public.

Related

Generate access token Instagram API, without having to log in?

So I am building a restaurant app and one of the features I want is to allow a user of the app to see photos from a particular restaurant's Instagram account.
And I want a user to be able to see this without having to login to their Instagram account, so they shouldn't even need an Instagram account for this to work.
So I have read this answer How can I get a user's media from Instagram without authenticating as a user?
And I tried what it said and used the client_id(which I recieved when I registered my app using my personal Instagram account), but I still get an error back saying :
{
meta: {
error_type: "OAuthAccessTokenException",
code: 400,
error_message: "The access_token provided is invalid."
}
}
The endpoint I am trying to hit is :
https://api.instagram.com/v1/users/search?q=[USERNAME]&client_id=[CLIENT ID]
So do I absolutely need an access token for this to work(and thus have to enforce a user to log in) ?
If I do, then is there way to generate an access token somehow without forcing the user log in?
I believe there is a way around this, as the popular dating app Tinder has this desired functionality I am looking for, as it allows you to see photos from people's Instagram account without having to log in! (I have just verified this 5 minutes ago!)
Any help on this would be much appreciated.
Thanks.
Edit April 2018: After facebook privacy case this endpoint is immediately put out of service. It seems we need to parse the JSON embedded in <script> tag directly within the profile page:
<script type="text/javascript">window._sharedData = {"activity_counts":...
Any better ideas are welcome.
You can use the most recent link
GET https://www.instagram.com/{username}/?__a=1
to get latest 20 posts in JSON format. Hope you put this to good use.
edit: other ways aren't valid anymore:
https://www.instagram.com/{username}/media/
Instagram used to allow most API requests with just client_id and without access_token, the apps registered back in the day still work with way, thats how some apps are able to show instagram photos without user login.
Instagram has changes the API specification, so new apps will have to get access_token, older apps will have to change before June 2016.
One way you can work around this is by using access_token generated by your account to access photos. Login locally and get access_token, use this for all API calls, it should not change, unless u change password,if it expires, regenerate and update in your server.
Since the endpoints don't exist anymore I switched to a PHP library -
https://github.com/pgrimaud/instagram-user-feed
Installed this lib with composer:
composer require pgrimaud/instagram-user-feed "^4.0"
To get a feed object -
$cache = new Instagram\Storage\CacheManager();
$api = new Instagram\Api($cache);
$api->setUserName('myvetbox');
$feed = $api->getFeed();
Example of how to use that object -
foreach ($feed->medias as $key => $value) {
echo '<li><img src="'.$value->thumbnailSrc.'"></li>';
}

How to reward members for having their invites accepted in Facebook canvas app?

I'm using the following Javascript for my users to send requests to "invitable friends" from my Facebook app:
FB.ui({
method: 'apprequests',
message: 'Come play with me etc.',
to: str_ids
},
requestCallback
);
function requestCallback(response){
if(response){
console.log(response);
}
else{
//show error to user
}
}
Where str_ids is a string containing the IDs returned by the invitable friends API. This all works fine.
When I invite a single user, let's say his Facebook ID is 1593894704165626, I get the following response:
request
"1399842883640198"
to
["1593894704165626"]
So here I have a unique request ID and the invited person's Facebook ID. I can now store this data in my database along with the inviter's ID, so I have all the necessary info.
However, now I want to reward the inviter after the invitee accepts the invitation and I'm running into a problem.
If user A and user B both invited user C, then when user C joins the game, how do I know whether to reward A or B?
I see from this question that it's possible to pass another parameter along with the invitation, which should help identify the inviter:
Facebook tracking who Invited whom
The first answer here suggests that you can pass such a custom parameter, but doesn't say how. Facebook's convoluted documentation is driving me insane.
Another thing - even if I send that additional parameter, I think there's a problem - for new users the app redirects to the Facebook page that checks whether they want to allow access to the app, and by the time they're redirected back to the app, the additional parameter will be lost.
Is there any solution to this?

Facebook API For Pulling Reviews

Has anyone seen a full example of how to pull facebook reviews using the graph api.
According to the docs:
A page access token is required to retrieve this data.
I have code that asks a user to login already and gets an auth token which I can use to post a message to their facebook feed. Is there an additional step I need to do to be able to read their reviews/ratings?
Here is an example of the code to post to their feed/page.
response = Curl.post("https://graph.facebook.com/#{page_id}/feed", {
:message => message,
:access_token => auth_token
})
Thanks
If you're referring to Page Ratings (different from App Reviews!), then the endpoint is
GET /{page_id}/ratings
as described here: https://developers.facebook.com/docs/graph-api/reference/page/ratings You'll need a Page Access Token for this.
Where I get a little bit confused is that you mention that you want to
read their reviews/ratings
In that case it's something else, because afaik it's currently not possible to query the User's Page ratings via Graph API or FQL. It's was only possible to query App Reviews via FQL (see https://developers.facebook.com/docs/reference/fql/review/) (Update: FQL is no longer available since 2016)
You need to set permission in the app to access the {GET /{page_id}/ratings} API. The permission is common for
/page/comments,
/page/posts,
/page/ratings,
/page/tagged,
and the permission name is "pages_read_user_content"
https://developers.facebook.com/docs/permissions/reference/pages_read_user_content

Can we get a facebook access token by providing email and password in the code?

I would like to get the photo urls from the from this album:
https://graph.facebook.com/175758929145317/photos
If you access it without providing an access token, then you will get empty data:
{
"data": [
]
}
But if you first generate an access token here:
http://developers.facebook.com/tools/explorer?method=GET&path=175758929145317%2Fphotos
And then you append it to the url like this, you can get the data:
https://graph.facebook.com/175758929145317/photos?access_token=your_access_token
However, this access token cannot be used forever, it will expire.
I would like to dynamically take the photo urls from https://graph.facebook.com/175758929145317/photos and display the images on a webpage, the person who views this webpage does not need to have a facebook account.
So every time the webpage is viewed, I am thinking about if it's possible to simply use my facebook account to login (by hardcoding the email and password) and then obtain a new access token so that I can get the photo urls.
Is this possible? Or is there a better solution to my problem? (I cannot ask the album owner to change his album to public)
it's not possible, you cannot authenticate in FB using hardcoded (or stored) login/password - as per Facebook policy:
I. Features and Functionality
...
3 - You must not include functionality that proxies, requests or
collects Facebook usernames or passwords.
what you can do instead:
Get (and then extend) token for yourself (see scenario 4 in this document: https://developers.facebook.com/roadmap/offline-access-removal/). That extended token should be good for 60 days - and then you might be able to extend it again.
Try to get those photos using APPLICATION token - and if it works, then the token is good forever: https://developers.facebook.com/docs/authentication/applications/

How to get all facebook pages id associated with my account?

I want to get the statistics of all the pages associated with my account on facebook, i have the code to get the statistics of a page, i just want to get the page id of all the pages associated with my account, how can i do this?
Please help.
Thanks.
You'll need to request the manage_pages permission (more details here), once you have the aquired the permission, all you have to do is make a request to :
https://graph.facebook.com/YOUR_FACEBOOK_ID/accounts.
The return value will be a JSON with all the pages/applications that are associated with your account.
You can also use this great tool that facebook provides - The Graph API Explorer (/me/accounts) to explore what other information you can retrieve without having to write a single line of code :P very useful.
FB.api('/me/accounts', function(response) {
for (id in response.data)
{
page = data[id];
page.id;
page.name;
}
});
You can use Javascript API to do this, read more :http://developers.facebook.com/docs/reference/javascript/