Is Facebook long-lived access token usable on multiple users?

Question

I'm experimenting with Facebook's long-live access token and I found that the long-lived access token is usable in different users. Is this normal?

I'm using the Facebook PHP SDK v3.2.2 and Yii. Here's my code to generate the long-lived access token from App_User_1

Yii::import('application.vendors.facebook.Facebook');
$facebook = new Facebook(
    array(
        'appId' => Yii::app()->params['facebookApi'],
        'secret' => Yii::app()->params['facebookSecretCode'],
        'cookie' => true,
    )
);
$loginUrl = $facebook->getLoginUrl(array('display' => 'touch', 'scope' => 'publish_actions'));
$fbUser = $facebook->getUser();
if(!empty($fbUser))
{
    $facebook->setExtendedAccessToken(); //long-live access_token 60 days
    $access_token = $facebook->getAccessToken();
    exit(print_r($access_token));
}

Here's my code to test posting to App_User_1 's Facebook wall.

$message = "A message";
$link = "http://www.alink.com";
$picture = "http://www.alink/image.png";
$sendTo = "`**App_User_1**`";
$access_token = "xxxxxxxxxx";

Yii::import('application.vendors.facebook.Facebook');
$facebook = new Facebook(
    array(
        'appId' => Yii::app()->params['facebookApi'],
        'secret' => Yii::app()->params['facebookSecretCode'],
        'cookie' => true,
    )
);

$attachment = array('message' => $message, 'link' => $link, 'picture' => $picture );
$api = "/$sendTo/feed/?access_token='.$access_token,";
$result = $facebook->api($api,'post', $attachment);

I have 2 test app user. If I substitute the App_User_1 's access token, I can also post into App_User_2 's Facebook Wall. Is this normal?

Answer 1

I think I may have been doing this the wrong way. Using the PHP SDK, the api method does not recognize the access_token as part of its path parameter. ( eg /me/feed/?access_token=blah )

Instead, the access token should be specified under optional parameters in an array format.

Here's how I got mine to work.

$facebook_uid = '1234567890';
//Initialize array for the params parameter
$fb_data = array();
$fb_data['access_token'] = 'xxxxxxxxxx';
$fb_data['message'] = 'A test message';
$facebook->api('/'.$facebook_uid.'/feed/', 'post', $fb_data);

Tried swapping the access token with other app user's access token and not specifying access_token at all. Both will result in error (#200) The user hasn't authorized the application to perform this action.

I would also recommend using this tool by Facebook to verify that the access_token is generated correctly by your app. https://developers.facebook.com/tools/debug