restfb: Writing a facebook application with java (using the new graph api)

Question

I'm trying to write a facebook application using Java tomcat with RestFB.

the restfb documentation shows the following:

Create a Facebook Application
Request https://graph.facebook.com/oauth/authorize?client_id=MY_API_KEY& redirect_uri=http://www.facebook.com/connect/login_success.html& scope=publish_stream,offline_access,create_event
Facebook will redirect you to http://www.facebook.com/connect/login_success.html? code=MY_VERIFICATION_CODE
Request https://graph.facebook.com/oauth/access_token?client_id=MY_API_KEY& redirect_uri=http://www.facebook.com/connect/login_success.html& client_secret=MY_APP_SECRET&code=MY_VERIFICATION_CODE
Facebook will respond with access_token=MY_ACCESS_TOKEN

I think that i may be looking at the wrong instructions and this is for a facebook connect or anything else besides an actual facebook application inside apps.facebook.com/app_name.

I would really appreciate any relevant information regarding the issue. I'm simply trying to create a simple facebook application that prints the name of the user.

In general after I fetch the acces token of the user i can do the following:

FacebookClient facebookClient = new DefaultFacebookClient(MY_ACCESS_TOKEN);
User user = facebookClient.fetchObject("me", User.class);
out.println("User name: " + user.getName());

My problem is how do i properly fetch the access token of the user? in the information i showed at the top of the post, it shows that i need to make 2 requests. the first for the code and the other for the acess token. and the request for the access token actually reveals my app secret key to the user because each time i forward him to a different page the user can easily view the get and set parameters.

so i guess i'm pretty lost here.

please help! :)

thanks

update after comments

with these instructions i need two times to redirect the user's page. first to get the code and then to get the access token. the user can see these two redirections and because of that he can easily see the facebook application key and secret key from the get parameters. how do i make sure that these steps are hidden from the user?

I am sorry but you're looking at correct doc. And those are the exact steps needed to take. Infact, you can run those steps from your browser. — Nishant
Alternately, use JOAuth if you want to create an OAuth 2 Authorization flow to your application (code.google.com/p/joauth). I am using it. — Buhake Sindi
"he can easily see the facebook application key and secret key from the get parameters" -- what's a big deal. Your app is tied to your domain. So, the request wouldn't be authenticated unless your domain deals with request-response. — Nishant

Kris Babic Kris Babic · Accepted Answer · 2011-03-10T00:24:01

As stated in the comments, these are the steps you need to take to access Facebook's graph API. However, to answer your second question:

"How do I make sure that these steps are hidden from the user?"

Only the first request should be performed by the user's browser. The purpose being that Facebook wants to make sure it is the sole authorization provide for the user's Facebook identity. Depending on the application you are writing, you would either use the redirect URL to point to the default redirect URL that you specified, or specify a custom url on your website that you will use to retrieve the token. The first approach is typically used by stand-alone applications such as mobile devices that can control how the browser handles redirects. The second approach would be used for a custom web-based application. Once you receive the access token, then you would perform the second operation within your code (using your favorite http apis) and not through the browser. The redirect on the access_token url is compared against the redirect url specified on the authentication-url. Facebook uses it for validation only and does not perform an actual redirect on the successful completion of the request.

Here are the high-level steps:

Redirect user's browser to the authentication-url specifying the appropriate redirect_uri
Retrieve verification token from redirected browser request
Perform access_token retrieval using your preferred HTTP framework (no user input required)
Parse results and retrieve access token
Initial restfb with token and use as needed

restfb: Writing a facebook application with java (using the new graph api)

update after comments

2 Answers