如何从客户端访问Facebook公共数据而不损害应用程序机密

Question

I'm trying to build a JavaScript metro app that pulls Facebook public data (posts from Home Depot for example) through their Graph API. It seems that an access token is always required to interact with the Graph API.

In order to obtain an access token, both the App ID and Secrets needs to be sent to the Facebook OAuth endpoint. This makes sense for server-side code but not for client-side, since the app secret cannot be shipped with client code that can be easily unpackaged/decomplied/intercepted.

So my questions are:

1. Is there a way to access the Graph API (public data) without using access tokens?
2. Is there a way to obtain an access token without sending over the App Secret?
3. Is there a replacement to the offline_access token?

Please keep in mind that:

1. I only need to access PUBLIC data.
2. NO user login is needed.

Thanks!

Answer 1

1. No

2. One option is to have the user log in and get an access token for them that way. Another would be to have your own server provide a token creation service, so the secret would not need to be in the app binary.

3. You can exchange a token to a longer-lived 60 day token https://developers.facebook.com/docs/facebook-login/access-tokens/#extending