I cannot publish an action from my site to a user's facebook wall. It worked until recently, but now I get :

{"error":{"message":"Error invalidating access token: Session has expired at unix time 1336381200. The current unix time is 1336546371.","type":"OAuthException","code":190,"error_subcode":463}}

every time.

I've searched google forever, reading about the facebook authorization process and access tokens, etc, but I'm not sure how they are implemented in the Drupal for Facebook module.

Any suggestions?

Thank you!

CommentFileSizeAuthor
#10 fb_access_token_7.diff7.15 KBDave Cohen
#9 fb_access_tokens.diff8.12 KBDave Cohen

Comments

phreestilr’s picture

phreestilr commented

Anyone?

I tried de-authorizing my app in facebook and then re-authorizing it, logging out of facebook and logging back in, I've read and re-read Drupal for Facebook's README.txt, I've read facebook's documentation, and I just can't figure it out.

My user access token never changes, even though it's been expired for about a week now.

Any help?

phreestilr’s picture

phreestilr commented

Ok, so I found one way to make this work (to publish open graph actions on objects). I used a slightly modified version of the code here: https://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expi... in order to make sure a valid unexpired user access token is set. I put the code in THEME_preprocess_html of template.php.

This probably is not very efficient, as it loads a facebook url with curl on every single page load, but at least it's working. I would like to do this in a more efficient manner and intend to try to. Any suggestions would be greatly appreciated!

Also, there is now a discrepancy in the user access token. Drupal for Facebook must have the old token cached, as it's showing that one in the fb_devel info block. I haven't found yet where this token is cached nor how to update it. Also, if I log out, it's not really logging me out.

mosco_dj’s picture

mosco_dj commented

subscribe

Mackee’s picture

Mackee commented

subscribe

Dave Cohen’s picture

Dave Cohen commented
Component: Facebook Connect » Code
Category: support » feature

Echoing what I said in #1809588: Post to facebook options not available - needs longer lasting token. Consolidating threads.

Facebook recently changed the rules around access tokens and made it tricky to get a long lasting one.

Try setting it up and getting it working. Don't log out of facebook or anything. Open a new browser or incognito window, and then try your test as another user. Hopefully the access token will still work.

For now there's no automated way to get the longer lasting token. Search facebook's doc and you'll find a curl command that you can use in a pinch. Sorry don't have the URL handy right now. You basically need to start with a token that has the extended permissions you need, then exchange that token for a longer lasting one. This used to be done by requesting "offline_access" which was much simpler.

Mackee’s picture

Mackee commented

This works on me.

On my facebook app, under settings > advanced, I change the Remove offline_access permission to disabled. And then I get a new Token. After that the token never expired. I then change the offline_access to enabled as default and the token still don't expire.

Dave Cohen’s picture

Dave Cohen commented

Yeah, I also still use offline_access on some apps. However, I do expect facebook to forcibly remove that option. Just who knows when. Their roadmap says that these offline_access tokens will automatically become 2-month-long tokens at some point.

artreaktor’s picture

artreaktor commented

For those who still having troubles with short-lived access token. You can create new long-lived (60 days) access token using request:

https://graph.facebook.com/oauth/access_token?             
    client_id=APP_ID&
    client_secret=APP_SECRET&
    grant_type=fb_exchange_token&
    fb_exchange_token=EXISTING_ACCESS_TOKEN

For detailed information read FB roadmap.

Dave Cohen’s picture

Dave Cohen commented
Title: Access token expired, no new token retrieved » Long lived access tokens
Version: 7.x-3.x-dev » 6.x-3.x-dev
Status: Active » Needs review
StatusFileSize
new fb_access_tokens.diff8.12 KB

Here's a patch currently for 6.x. Might apply to 7.x, might need some tweaks. Anyway it allows a user to get a long-lived token instead of the default short lived.

But still it will not retrieve a new token after one expires. Can't be done as far as I know that would be a security hole.

Dave Cohen’s picture

Dave Cohen commented
StatusFileSize
new fb_access_token_7.diff7.15 KB

Here's same patch for D7.

Dave Cohen’s picture

Dave Cohen commented
Status: Needs review » Fixed

Marking fixed because pushed to .dev builds.

Still would appreciate review especially if anyone encounters problems.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

phosgen’s picture

phosgen commented
Version: 6.x-3.x-dev » 7.x-3.x-dev
Category: feature » support
Status: Closed (fixed) » Needs review

It seems possible to ge ta new Token through the app when the "expired token" error appears.

See:
Catch Token errors

And theres also an option to extend existing tokens:
https://developers.facebook.com/docs/facebook-login/access-tokens/#extending

Im not sure if this can be implemented through this module or whethere this has to be done within the app itself.

mubiesam’s picture

mubiesam commented

Is this updated in the latest version...

akosipax’s picture

akosipax commented
Issue summary: View changes

I have 3.4 and this doesn't seem to be fixed yet. The fix is in dev though so I wonder when we can get another release in the 3.x branch. I can't apply the patch in my 3.4 installation.

liquidcms’s picture

liquidcms commented

I am just trying to set this up and after a few hours my token expired and Drupal for FB would do nothing but spit out error messages after that. I went and created a new token and pasted in and things worked again...

BUT.. what am i missing here? it would seem as though this makes this module pretty much unusable doesn't it. Is the site admin expected to re-enter tokens every few hours, days, etc? Surely that can't be the proper use of this.