Facebook access token only valid for user that created the facebook application

Question

I have some JavaScript that logs in a Facebook user and saves the access token to a database:

window.fbAsyncInit = function () {
    FB.init({
        appId: '<%=FaceBookApplicationId() %>',
        status: false, // check login status
        cookie: true,
        oauth: true
    });
};

function facebookLogin() {
    FB.login(function(response) {
        if (response.authResponse) {
            __doPostBack('__Page', 'FacebookDeliveryButton: ' + JSON.stringify(response.authResponse));
        } else {
            console.log('User cancelled login or did not fully authorize.');
        }
    }, { scope: 'offline_access,read_stream,publish_stream,user_photos' });
}

A button click fires facebookLogin() which logs in a facebook user, getting a facebook session that includes an access token, which I JSON serialize and post to the server. The server then saves this access token to the database table FacebookDeliveryQueue.

I have a Windows service running that periodically queries the FacebookDeliveryQueue table and attempts to post on a user's wall using the access token we saved earlier:

IQueryable<FacebookDeliveryQueue> toSend = objectContext.FacebookDeliveryQueues.Where(p => !p.IsDelivered);
foreach (FacebookDeliveryQueue facebookDeliveryQueueItem in toSend)
{
    string facebookAccessToken = facebookDeliveryQueueItem.Cart.FacebookAccessToken;
    string facebookRecipientId = facebookDeliveryQueueItem.Cart.FacebookRecipientId;

    var client = new FacebookClient(facebookAccessToken);
    dynamic parameters = new ExpandoObject();
    parameters.message = facebookDeliveryQueueItem.Cart.CustomMessageBody;    
    client.Post(facebookRecipientId + "/feed", parameters);
}

My problem is, this ONLY works with access tokens from the user that created the facebook application. Eg

Success: I, the creator of this application, log in and pick one of my friends to send a message to, this info is saved to the database, the service runs, my message is posted to my friend's wall.

Failure: I log in on my dummy test account (approving the app permissions on this account), pick one of my dummy test account's friend, this info is saved to the database, the service runs and throws an invalid access token error.

Any ideas why?

Update: Switched to Oauth login -- no change. Still getting "(OAuthException) Invalid access token signature." when attempting to post to friend's wall.

Answer 1

Looks like you're using facebook's old login methods, which they recently just turned off, so your old access tokens aren't valid anymore? And your javascript isn't generating the right kind of token. Read the latest version of the FB.login documentation for more info on what changes you need to make. Specifically,

• pass oauth: true to the FB.init call
• check for response.authResponse instead of response.session now.

Also, check that your app isn't in "sandbox mode". Go to the app settings page and click on "advanced". Sandbox mode makes it so that only developers can use the app.

Answer 2

The persistence to the database was silently trimming the access token to 75 characters, which in the case of my own user, was enough (small user id because it's an old account) -- but five characters too short in the case of my test account which has a very large user id.

Woops.