Creating a post by sending HTTP request to Facebook API
Question
I want to post on my facebook page by sending a HTTP POST. The way I am doing this is by creating a permanent access_token that is used to post to my facebook page. The problem is the access_token can be easily taken/inspected using firebug or any other tool (since it is hard-coded). How can I send it in a way that is kept from others.
$appID = 'MY_APP_ID';
$fb_page_id = 'MY_PAGE_ID';
$fb_page_access_token = 'PERMANENT_ACCESS_TOKEN';
$html = '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">'
. '<html><body>'
. '<div id="fb-root"></div>'
. "<script type=\"text/javascript\">
function post_to_fb(commentText, commentUsername, commentLink) {
var logoName = get_logoname_from_link(commentLink);
var strURL = 'https://graph.facebook.com/" . $fb_page_id . "/feed';
var params = 'link=' + commentLink + '&name=Brandchamp+-+' + logoName + '&message=[' + commentUsername +'+commented on ' + logoName + ':]+' + commentText + '&access_token=" . $fb_page_access_token . "';
var xmlHttpReq;
xmlHttpReq = new XMLHttpRequest();
xmlHttpReq.open('POST', strURL, true);
xmlHttpReq.setRequestHeader('Content-type','application/x-www-form-urlencoded');
xmlHttpReq.send(params);
}
window.fbAsyncInit = function() {
FB.init({
appId: " . $appID . ",
status: true,
cookie: true,
xfbml: true,
});
FB.Event.subscribe('comment.create', function(response) {
var commentQuery = FB.Data.query('SELECT fromid, text FROM comment WHERE post_fbid=\'' + response.commentID + '\' AND object_id IN (SELECT comments_fbid FROM link_stat WHERE url=\'' + response.href + '\')');
var userQuery = FB.Data.query('SELECT name FROM user WHERE uid in (select fromid from {0})', commentQuery);
FB.Data.waitOn([commentQuery, userQuery], function () {
var commentRow = commentQuery.value[0];
var userRow = userQuery.value[0];
var commentText = commentRow.text;
var commentUsername = userRow.name;
post_to_fb(commentText, commentUsername, response.href);
});
});
};
(function() {
var e = document.createElement('script');
e.async = true;
e.src = document.location.protocol + '//connect.facebook.net/de_DE/all.js';
document.getElementById('fb-root').appendChild(e);
}());
</script>"
. '</body></html>';
print $html;
2 answers
solution1
3 2012-04-03 16:23:25
只是不让用户看到您的访问令牌：您必须创建某种代理，该代理将发布到您的页面墙服务器端
solution2
0 2012-04-04 07:19:02
Whats the problem if a user who is granting you permission can see his/her own access_token in firebug. Firebug is on client side only. Also, official javascript sdk gives access_token to client. I dont think its bad.
User can always see his/her own password :) . What is bad in it ?
You should care about sniffing access_token over network. As @Juicy suggested use https to overcome that situation.
Edit after reading comment:
In your situation, I would suggest not to use javascript/ajax.
Also, I would recommend to use an sdk over your own php code. An sdk uses all security measures which should be taken.
Official php sdk:
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.