0

With the recent deprecation of offline_access, Facebook is allowing apps to "extend" short-lived tokens to long-lived ones. The tokens can also be "renewed" as long as they haven't expired yet. [1]

This would make sense to me from a security/privacy perspective if the "extend" required explicit user opt-in (like the old offline_access permission). But it seems that apps can both extend and renew transparently, without user action. E.g. iOS apps do this with a simple HTTP request. [2][3][4]

Given that, what's the purpose of this feature? It doesn't seem more secure/private than expiring tokens, and it doesn't seem more convenient for apps than lifetime tokens (e.g. Twitter and LinkedIn).

[1] https://developers.facebook.com/roadmap/offline-access-removal/

[2] https://developers.facebook.com/docs/mobile/ios/build/#extend_token

[3] https://developers.facebook.com/docs/reference/iossdk/authentication/

[4] https://github.com/facebook/facebook-ios-sdk/blob/v1.2/src/Facebook.m#L352-L359

2 Answers 2

0

well, the way I read documentation:

Scenario 4: Client-side OAuth and Extending Access_Token Expiration Time through New Endpoint

Using the new endpoint below, you will be able to extend the expiration time of an existing, non-expired, short-lived user access_token. Please note, the endpoint can only be used to extend the short-lived user access_tokens. If you pass an access_token that had a long-lived expiration time, the endpoint will simply pass that same access_token back to you without altering or extending the expiration time.

If you would like to refresh a still valid long-lived access_token, you will have to get a new short-lived user access_token first and then call the same endpoint below. The returned access_token will have a fresh long-lived expiration time, however, the access_token itself may or may not be the same as the previously granted long-lived access_token.

it sounds to me that you cannot endlessly extend your token. And the goal is, the way I understand it, to prevent apps from having tons of users who do not use the app - but app still has access to user's data. So FB wants to remove access to users' data for the apps which nobody is using.

Regarding

But it seems that apps can both extend and renew transparently, without user action. E.g. iOS apps do this with a simple HTTP request. [2][3][4]

that will work only if user is logged in Facebook and is using iOS app which uses facebook app inside it. That means that user is active, and is using the app. If user won't use it for 60 days, that token will expire and cannot be extended automatically anymore. But this contradicts to "Scenario 4" above... not sure what to take from it.

5
  • Thanks for the response. I'm not sure that the Facebook iOS app comes into play -- you switch to it for initial login, but not for these renewals. So it doesn't seem that the Facebook iOS app has any part in this beyond initial login. May 18, 2012 at 19:02
  • Also, given that the HTTP request doesn't go through the Facebook app, one could just make the request from a server instead of from the app. Looking at the codebase (link 4 in my question), it's a straightforward HTTP request. May 18, 2012 at 19:03
  • i did not mean Facebook iOS app - i meant YOUR app (e.g. Evernote) which is capable of posting to FB wall. And as long as you are logged in into your Facebook account, that other app can transparently renew tokens.
    – avs099
    May 18, 2012 at 19:05
  • But my point is that the request to extend/renew is a simple HTTP request that doesn't require user action, so it doesn't require the user using the app. The request could even be made on a server. May 18, 2012 at 19:10
  • right - not sure what to make of it. The link I posted clearly states that should not be possible...
    – avs099
    May 18, 2012 at 19:15
0

Not having heard any better answer, my best guess is that they do want apps to have long-term access (without having to ask the user repeatedly), while reducing the damage a compromised token could do (because it expires).

I'm not sure if that's the case, because I'm not sure whether compromised tokens have actually been an issue in practice (since the app developer can still easy revoke a compromised token).

Another possibility a friend mentioned is that this helps Facebook collect more data/analytics on app usage. But I'm not sure if that's the case either, given that it seems tokens can be renewed without user input or intervention.

So at this point, my best guess is for slightly improved security while still allowing apps to have long-term access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.