SoftwareEngineering

refreshes and extends each time the user triggers the login flow

Extending

user access tokens

response from this endpoint will include the

exchange this token for a longer-lived one

passing it to the /oauth endpoint from your server

grant_type parameter of fb_exchange_token

/oauth/access_token

grant_type=fb_exchange_token

fb_exchange_token=SHORT_LIVED_ACCESS_TOKEN

by default you'll receive a short-lived token that is only valid for 1-2 hours

token identifies a User, App or Page session and provides information about granted permissions

Types

User Access

generated in the login flow when a

Facebook Pages

use this token to perform API calls

Page Access

used to

user who is the

App Secret or an App Access token should never be included in any code that could be accessed by anyone other than a developer of the app

must grant an extended permission called

use this type of token to make API calls

unique to each page, admin and app

App Access

useful to modify app settings, create and manage test users or read App Insights data

use app tokens to publish or delete content

unique to each app

Security Best Practices

extremely important that an App Secret is not compromised

App Access Tokens should only be used directly from your app's servers in order to provide the best security

dalicore-ejb

DaliCore is based on the Java EE 6 API's

dalicore-oauth

leverage authentication provided by Social Networks

dalicore-externalnetwork

demos directory

JPA configuration

dalicore-oauth persistently stores its request and access tokens, its users and its list of service consumers

JSON-P

new API being added to Java EE 7

Java API for JSON Processing

API to enable developers to parse, generate, transform and query JSON, particularly in JAX-RS and WebSocket powered next-generation HTML 5 applications