drxnfdx798517235 2012-09-17 22:20
浏览 63
已采纳

Facebook提要:年龄限制页面的永久用户身份验证令牌

This used to be a relatively simple thing to do (not as simple as it was a year ago, and now even less simple). Caveat: I am not well-versed in the Facebook API — I don't build apps; I just build web sites, and every once in a while need to display a simple (but far too custom for a facebook widget) display of a facebook page's feed. No problem, usually, but…

I usually just used a client token — just generated it once and stored it permanently as a variable. But for this site, accessing the feed requires a user access token because it's age-restricted (alchohol site). The way this would have been done earlier is to just generate a token with "offline_access", and I could store that permanently as a variable. But offline_access has been deprecated.

From what I understand, now my only option is a long-term access token. But these must be extended every sixty days.

All I want to do is display a feed — I don't want the user to have to do anything but see the feed — never be prompted to log in, etc. And I certainly don't want myself or my client to have to generate a new token every two months.

Is there some simple, permanent (I mean, until facebook changes the rules again) way to do this?

  • 写回答

1条回答 默认 最新

  • doutao1282 2012-09-17 23:11
    关注

    The offline access feature is still enabled but is deprecated and will (very soon) be removed.

    Facebook does not provide an exact replacement for this feature. The only thing to do is to generate a long term token and regenerate it when it's about to expire.

    In other words (as Facebook conceives it, I guess) : if the user does not visit your site for more than 60 days, then they're not interested anymore and you can no longer access their data.

    If it's not the case, you could simply renew the token from time to time. As you know the token's expiration date (the API returns it along with the token), you can store it and check the best opportunity to display the connection dialog. Even if the 60 days delay have expired, you could fetch a new token when they are back without asking for permissions again.

    You can think of it exactly as the "remember me" cookie. It's meant to provide comfort, not to circumvent security policies : it's irrevocability (by simple means) causes privacy and security issues.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 c语言怎么用printf(“\b \b”)与getch()实现黑框里写入与删除?
  • ¥20 怎么用dlib库的算法识别小麦病虫害
  • ¥15 华为ensp模拟器中S5700交换机在配置过程中老是反复重启
  • ¥15 java写代码遇到问题,求帮助
  • ¥15 uniapp uview http 如何实现统一的请求异常信息提示?
  • ¥15 有了解d3和topogram.js库的吗?有偿请教
  • ¥100 任意维数的K均值聚类
  • ¥15 stamps做sbas-insar,时序沉降图怎么画
  • ¥15 买了个传感器,根据商家发的代码和步骤使用但是代码报错了不会改,有没有人可以看看
  • ¥15 关于#Java#的问题,如何解决?