How to leave user signed-in in facebook canvas app after having got an extended auth token?

Question

I have gotten an extended auth token via PHP SDK 3.2.2.

$facebook->setExtendedAccessToken();
$access_token = $_SESSION["fb_".$cfg['app_id']."_access_token"];
$facebook->setAccessToken($access_token);
$accessToken = $facebook->getAccessToken();

I understand now I can make queries with this $accessToken

However, after 2 hours in canvas app, a window asking to Play the game pops up again. I tried viewing $facebook->getSignedRequest() and it has a property oauth_token which is not equal to $accessToken but is older, of 2 hours length.

What steps should I take to keep users authorized and avoid popup window that asks if users want to play or not.

Answer 1

Now I'm not sure if you're using the Facebook JavaScript SDK in addition to using the PHP one but what you could do is use FB.getLoginStatus() periodically (say every 10 minutes) to keep the session alive on Facebook's end.

With games that we've created we came across this issue of timeouts and we found that doing a periodic ping of Facebook's API kept the user's session alive.

Answer 2

Fix the bug in the setExtendedAccessToken() method within the base_facebook.php library.

Find this code at the bottom of that method:

$this->destroySession();

$this->setPersistentData(
  'access_token', $response_params['access_token']
);

Add this line immediately following:

$this->accessToken = $response_params['access_token'];

Without that line, the access token is only stored in persistent data. I think you tried to get it out of Session[...], but it must still not be the correct token.

I had this exact same problem, where I couldn't get the extended token no matter what I did. I added the above line, and then re-entered the app through the apps.facebook.com so it would generate a signed request. Each of my test users properly picked this up and stored a token in session with an expiration date 60 days out.