Python：具有访问令牌的动态Facebook图片网址的最佳做法

Question

I've got a Django app where users can sign up with facebook. I'm using facebook-sdk to query the Facebook Graph API. I'm running into a problem when constructing a profile picture url for a given user.

According to various sources, I can render the user's picture at various widths using the following:

<img src="https://graph.facebook.com/{{facebookUserId}}/picture?type=square&width=500">

That way, I don't have to store the user's picture when they sign up. However, if the user's picture is private, I need to append an access token like so:

<img src="https://graph.facebook.com/{{facebookUserId}}/picture?type=square&width=500&access_token={{accessToken}}">

The problem is that the access token will eventually expire. I can convert a short access token (from the facebook javascript SDK) to a long-lived access token via the Graph API, but eventually even that token will expire, and at that point I won't be able to render the image anymore.

I can store the expiry date of the token on the user model to check when it's expired:

class User(models.Model):
    accessToken = models.CharField(...)
    accessTokenExpires = models.DateTimeField(...)

But then I have to check whether the access token is expired every time I need to render the picture, which probably means I should use a URL from my own backend, like /picture/<userId>?size=500 which would redirect to graph.facebook.com/<userIdGoesHere>/picture?type=square&width=500&access_token=<accessTokenGoesHere> with the stored accessToken, but at that point I lose the speed of using Facebook's CDN to render the image.

I suppose I could try to update the tokens of all my users with a cron'd worker task, but that doesn't seem ideal as the number of users grows and I'm wondering if there's a better way.

What's the best practice for keeping these tokens up to date while still dynamically rendering an image URL?

Answer 1

• if an access token is rejected do regenerate it . An access token might be revoked when user changes his password
• Request your long lived token and store it with metadata when to refresh it : https://developers.facebook.com/docs/facebook-login/access-tokens/expiration-and-extension
• you might consider to cache things like profile photos