Skip to content

Commit

Permalink
Use the Facebook 2.2 Graph API instead of 1.0.
Browse files Browse the repository at this point in the history
Facebook is making a change on April 30th: all users of the previous
unversioned Facebook API will automatically start using the 2.0 API, and
the 1.0 API will be unavailable.  By upgrading your Meteor to include
this commit, you will be able to start adapting your app to the post-1.0
world now rather than next month.

Full information about the changes to Facebook's APIs can be found at
https://developers.facebook.com/docs/apps/upgrading

If you only use Facebook integration for login via accounts-facebook,
and don't use users' access tokens to access the Facebook API on their
behalf, then the only changes you are likely to observe are:

- The `id` returned by Facebook for users who had not previously used
  your app will be an "app-scoped ID". You cannot use these to directly
  correlate users between multiple apps (without using the Business
  Mapping API).  This does not affect users who have already logged in
  to your app, so they will continue to be able to access your app.

- Meteor asks for the `email` permission by default, and copies the
  `email` field from the `/me` object into the `serviceData.facebook`
  field on `Meteor.user()`, along with other fields which only require
  the `public_profile` permission. With 2.0, users can decline to grant
  all permissions other than `public_profile`, which means that you
  might not get their `email` address. You can use the `/me/permissions`
  API to tell if permissions were declined.

Additionally, if you are accessing other Facebook APIs using the
`access_token` returned via login, you should be aware that some
permissions have changed in Facebook Graph API 2.0 and newer. Most
notably, many operations involving friends need permissions such as
`user_friends` to be explicitly requested now.  Users can decline any
permission (other than `public_profile`).  Apps which need permissions
other than `public_profile`, `email`, and `user_friends` may need to
pass through a review stage before being fully activated.

To change your app to request new permissions such as `user_friends`,
specify the `requestPermissions` option to
`Meteor.loginWithFacebook` (if you implemented your own login UI) or to
`Accounts.ui.config` (if you are using the `accounts-ui` package).

Note that while Meteor will now always use the v2.2 API to fetch the
access token, it does appear that the access token can still be used to
access pre-v2.2 APIs.  For example, you can still use the access token
to run FQL queries, even though FQL was removed in API v2.1.

Fixes meteor#3123.
  • Loading branch information
glasser committed Mar 23, 2015
1 parent 3a4a327 commit bedebc1
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion packages/facebook/facebook_client.js
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ Facebook.requestCredential = function (options, credentialRequestCompleteCallbac
var loginStyle = OAuth._loginStyle('facebook', config, options);

var loginUrl =
'https://www.facebook.com/dialog/oauth?client_id=' + config.appId +
'https://www.facebook.com/v2.2/dialog/oauth?client_id=' + config.appId +
'&redirect_uri=' + OAuth._redirectUri('facebook', config) +
'&display=' + display + '&scope=' + scope +
'&state=' + OAuth._stateParam(loginStyle, credentialToken);
Expand Down
4 changes: 2 additions & 2 deletions packages/facebook/facebook_server.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ var getTokenResponse = function (query) {
try {
// Request an access token
responseContent = HTTP.get(
"https://graph.facebook.com/oauth/access_token", {
"https://graph.facebook.com/v2.2/oauth/access_token", {
params: {
client_id: config.appId,
redirect_uri: OAuth._redirectUri('facebook', config),
Expand Down Expand Up @@ -87,7 +87,7 @@ var getTokenResponse = function (query) {

var getIdentity = function (accessToken) {
try {
return HTTP.get("https://graph.facebook.com/me", {
return HTTP.get("https://graph.facebook.com/v2.2/me", {
params: {access_token: accessToken}}).data;
} catch (err) {
throw _.extend(new Error("Failed to fetch identity from Facebook. " + err.message),
Expand Down

0 comments on commit bedebc1

Please sign in to comment.