Facebook的deprecation的offline_access许可将于 2012 年 5 月发布，但文档没有为我们提供有关如何处理它的足够信息。

我们有一个 iOS 应用程序和相应的服务，为其提供支持并与 Facebook 深度集成，以在应用程序内利用用户的 friend 列表(因此，如果您的 FB friend 也在使用该应用程序，您可以更轻松地建立联系)。这就像所有社交应用程序的工作方式一样，所以这里没什么特别的。

客户

我们的应用程序使用 Facebook iOS SDK允许用户登录，我们目前要求 offline_access . token 保留在我们的 iOS 应用程序中，但也会发送到保存它的服务器。客户端代表用户向用户的新闻源发布更新(我们还请求 publish_stream 权限)。

服务器

我们的服务器会定期检查用户的 FB 好友是否正在使用我们的应用程序。下次用户登录时，我们会以某种方式公开内容和关系以宣传该用户的 friend 。服务器还代表用户定期连接到图 API 并获取用户的当前好友列表。这样我们就可以解释用户关系的变化，并将它们反射(reflect)在我们的应用程序中。当用户当前未使用该应用程序时，我们会执行此操作，以便他们在下次使用该应用程序时获得最佳体验。为了实现这一点，我们的 iOS 应用程序将访问 token 发送到它使用的服务器以及我们为什么要求 offline_access .

注:如果用户明确退出我们的应用程序，我们会从客户端和服务器中删除访问 token 。

问题

既然不再有我们可以使用的永久访问 token ，我正在尝试找出最佳实践，以在利用 facebook 处理和扩展访问 token 的新预期方式的同时仍然启用我们的场景。不幸的是，文档并不完全有帮助。

问题

答:当您通过最新的 Facebook iOS SDK 进行身份验证时，您获得的访问 token 的默认生命周期是多少？ This document说一个扩展的 token 请求会给你一个持续 60 天的 token 。这个other document谈论第一个访问 token 请求并提到不同的有效性，但它是 unclear它是否谈论具体的有效期:

(重点是我的)

When you obtain an access token from Facebook, it will be valid immediately and usable in requests to the API for some time period defined by Facebook. After that period has elapsed, the access token is considered to have expired and the user will need to be authenticated again in order for your app to obtain a fresh access token. The duration for which a given access token is valid depends on how it was generated.

There are also events which may cause an access token to become invalid before its expected expiry time. Such events include the user changing their password, an application refreshing it's App Secret. Dealing with varying access token expiry times, and handling the case when an access token becomes invalid before its expected expiry time is essential for building robust social experiences.

Can I exchange my 60 day access token for a new 60 day access token?

No, sorry you cannot. You can only exchange a valid (meaning current) user access token for an extended one. You cannot extend an already extended access token.

最佳答案

概述

我相信 facebook 试图实现的根本目的是防止应用程序永久永久访问用户帐户。因此，在新的迁移中，除非用户再次登录，否则应用只能访问一个帐户 60 天。

我不为 facebook 工作，但这是我在玩 facebook graph api 时的发现。

通用解决方案

A. When you authenticate through the newest Facebook iOS SDK, what is the default lifetime of the access token you get? This document says an extended token request will give you one that lasts 60 days. This other document talks about the first access token request and mentions varying validities but it's unclear and does it talk about specific validity times:

B. For the client, now that the access token isn't necessarily long lived, is the right approach for us to: Let use login through FB, then detect whenever the access token is expired. If it is, then call into FB iOS SDK to re-authentication/re-authorize? (this should just trigger user to bounce out to FB iOS app, and in most cases come immediately back to our app with a new access token).

C. According to this blog post I found, you can only extend an access token once. On the client, I can just handle this by prompting a re-authentication/re-authorization as I mentioned in Question B. However, this doesn't work on our server. We could certainly have the server renew it once to 60 days, but what happens on the 61st day? The server just stops being able to sync the friend's list?

D. It seems to make sense to check the validity of the FB access token every time the app starts or re-hydrates from sleep. What is the best way for our iOS app to check this? Is there a recommended endpoint to call to validate a token? Should we just call into https://graph.facebook.com/me passing the access token and checking the response?

关于ios - 当您在 iOS 应用程序和服务器中都使用 token 时如何处理 Facebook 弃用的离线访问权限，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/10132610/