The Facebook Graph and OAuth 2.0
During my recent Facebook app development using Java, I had to have some minor integration with Facebook, and I am here to share what I have learned and the cool parts about Facebook’s “Graph.”
Introduction to Working with Facebook
When writting my application, it happened to be a canvas app, or it was accessed via apps.facebook.com with a iframe to my acctual app. When I would get a new user I would immediatley get a new cookie that was named fbs_APPID within this cookie, most importantly, there was a access token. Now to know any information about a user, one must have one thing, an OAuth access token.
Getting an OAuth access token
Most times you will have a token in the cookies, however on some random times that I never figured out the pattern to, you just don’t have that information there. And as for most apps, you need to know some information about a user, and possibly even post or something of the like with the users permission. However, for protection, Facebook just doesn’t allow any application developer access to their entire database. So to allow only certain access to certain applications, applications are given OAuth tokens, these tokens are user specificic and generally session specific. With these tokens, you could use the later discussed Facebook Graph to get just about any needed data.
The process of getting an OAuth token if it is not in the “fbs_” cookie can be quite strenuous. First you need to redirect the user to the Graph server with certain application-specific parameters. Next, one of the parameters happened to be a call back url, now that url is called and Facebook gives you a code. Using this code and your application secret you can finally get a new OAuth access token. Basically what all these redirects does is allow Facebook to check that this user is acctually logged in and that this user is allowing the application access to this information.

