Facebook login in ASP.Net and persist user

Question

I am allowing users to use facebook to login to my website and whenever user visits next time and use facebook as a login method, I should be able to identify that user as an existing.

For your kind understanding this is how flow should work: New user visits the website and choose Facebook to login, user is redirected to FB login page, user fills out the username & password and once I receive the Access Token code from FB, I will store that info in my Db. Next time when user visits the site and chooses the Facebook as a login method, after the authentication on the Facebook page, it should return the same Access Code it returned during first time, so I can compare that against already stored Access Token code and decides whether it's an existing user or I need to create new Account.

In order to achieve above, I am referring https://developers.facebook.com/docs/howtos/login/server-side-login/

For some reason the Access Token keeps expiring and it does not match the Access Token already stored in Db, Am I doing something wrong / may be I am misunderstanding the concept here. Any help is much appreciated.

Answer 1

I know this is late, but I'm working on a similar issue and trying to find a solution.

Your problem here is that Facebook issues an access token which is kind of like the user's session key to your application. It does expire and that should be planned for. When that happens you need to request a new one on the next user visit. If you want a rolling session expirey, you will need to trade that already valid access token for a new one that expires later.

When you do your subsequent logins you will also get the facebook user id as well as the new token. That is what you should compare in your database to determine who it is.

I am a bit stuck on persistent logins myself.