facebook offline_access

Question

ma web application uses the offline_access. As it will be deprecated by the first of may I am wondring how to manage the validity of the access_token. In the documentation https://developers.facebook.com/roadmap/offline-access-removal/ they say (If the access_token is generated from a server-side OAuth call, the resulting access_token will have the longer expiration time) ! What is this "the longer expiration time?" and how I know that my token is not valid anymore?

Any one can help me? Thanx !

Answer 1

From the page that you linked to in your question, the longer expiration time is 60 days:

To get the access_token simply pass your own client_id (your app_id), your app_secret, and the client-side access_token to the endpoint below. The returned access_token will be set to expire in 60 days . If you would like to renew a still valid access_token, you will have to get a new client-side access token first and then call the same endpoint below. The returned access_token with the newly extended expiration time may or may not be the same as the previously granted extended access_token.

And here is how to handle expired access tokens .

Answer 2

It's nice of Facebook to remove this. Really messes up a lot of our work! Now do you think that having a small windows/unix service running that could call the new end point say every 30 days with the right values would "solve" this. It's not looking like the user has to be physically on your site as the end point is:

https://graph.facebook.com/oauth/access_token?             
    client_id=APP_ID&
    client_secret=APP_SECRET&
    grant_type=fb_exchange_token&
    fb_exchange_token=EXISTING_ACCESS_TOKEN

as you are just calling a URL and parsing the details? So when someone connects to your app, get the new extended access token, save this to your db along with the expires date and with a the right setup up, call the URL every 30 days (or even 59 days if you want to play on the edge...) and up date it without the user ever needing to be physically on your site. Seems like too easy away to get around the security...?