Facebook Rest API working but auth issue with Android SDK

Question

I am currently using thus url to test the Facebook graph API and get my page feed to display it in my application: DOC: https://developers.facebook.com/docs/graph-api/reference/v2.2/page/feed

https://graph.facebook.com/PAGE_ID/feed?access_token=APP_ID|APP_TOKEN (all ID obfuscated but I can share them and create a new app id needed)

So, this feed is working fine and gives me the JSON output I need:

{
data: [
{
id: "blahblah",
from: {
category: "Industrials",
name: "blahblah",
id: "blahblah"
},
message: "blahblahhttps://www.blahblah.com/",
picture: "https://fbexternal-a.akamaihd.net/safe_image.php?blahblah.jpg",
link: "https://www.blahblah.com/",
name: "Home",
caption: "blahblah",
description: "blahblah.",
icon: "https://fbstatic-a.akamaihd.net/rsrc.php/v2/yD/r/aS8ecmYRys0.gif",
privacy: {
value: ""
},
type: "link",
status_type: "shared_story",
created_time: "2015-01-21T12:30:37+0000",
updated_time: "2015-01-21T12:30:37+0000",
shares: {
count: 2
},
likes: {

Proble is that I want to use exactly the same feature, but instead of parsing JSON, I would like to use Facebook SDK.

This is my current code:

new Request(
                null,
                "/PAGE_ID/feed?access_token=APP_ID|APP_TOKEN",
                null,
                HttpMethod.GET,
                new Request.Callback() {
                    public void onCompleted(Response response) {
                        Log.e("CVE","MESSAGE: "+response.getError().getErrorMessage());
                    }
                }
        ).executeAsync();

But this method gives me some authentification issues.

I get the response: "Invalid OAuth access token signature"

Any idea what is wrong and if I have to use the HTTP request instead of Facebook SDK?

You should NEVER put your app secret in an Android app. A user will extract it and will now be able to do request as your app. — WizKid
This is NOT the app secret, this is the app token, as recommended that I got from here: graph.facebook.com/oauth/… (where I indeed gave my secret once) — Waza_Be
Where did you read you can use APP_ID|APP_TOKEN as access token? I'm pretty sure that is impossible and that is why you get the error. According to developers.facebook.com/docs/facebook-login/access-tokens : "Again, for security, app access token should never be hard-coded into client-side code, doing so would give everyone who loaded your webpage or decompiled your app full access to your app secret, and therefore the ability to modify your app." — WizKid
Try above link with your app ID ans secret, it will give you a token with ID and TOKEN. I can swear you the http link I gave in my question is working fine — Waza_Be
Does it matter if it works or not? The documentation say not to do it — WizKid

Ming Li Ming Li · Accepted Answer · 2015-01-29T19:11:16

As @WizKid said above, NEVER put your app_token into a client app, that is a huge security hole. Only use user access tokens in your app. Alternatively, make the request server-side, and pass it on to your client app.
You're not using the Request methods properly. If you look at the documentation for the Request class (https://developers.facebook.com/docs/reference/android/current/class/Request/), you'll see that the second parameter is "graphPath", which should be only the "path" component of a URL. You are, however, including a query string as well, which is where things break. What you should do is something like this:

Bundle params = new Bundle();
params.putString("access_token", "YOUR_ACCESS_TOKEN");
new Request(
            null,
            "/PAGE_ID/feed",
            params,
            HttpMethod.GET,
            ...

Alternatively, you can also use the Session object instead (to get the user access token).

Facebook Rest API working but auth issue with Android SDK

1 Answers