[Facebooker-talk] Session Best Practices

Joel Watson
2008-06-12T23:27:49Z

I''m not sure exactly how this will work, but will affect the app
I''m
working on as well. The official post about this change is located here:

http://developers.facebook.com/news.php?blog=1&story=118

It appears as though you''ll be able to get a new user session without
already having an infinite session key via the Auth.getSession method.
It also appears as though you''ll be able to do Profile.setFBML without
an existing session key as well. As I said though, I''m not 100% sure
how this will work. If anyone out there has a better idea, please
chime in! I''ll probably be playing around with this some time in the
next week or two in any case.

-Joel

On Jun 12, 2008, at 3:32 PM, William Thomas wrote:

> Wow fast responses, awesome!
>
> The session reconstitution won''t work for much longer is because
of
> the change in the Facebook API policy, correct? What will be the new
> way to store this, if any ? I have heard that you can still get the
> user to voluntarily allow the session key to never expire.
>
> I still have the issue with "update status" - facebooker
doesn''t
> think it is enabled when it really is.
>
> As for the ensure_authenticated_to_facebook being controller wide -
> is that a good practice or will it cause me problems later on?
>
> --- On Thu, 6/12/08, Mike Mangino <mmangino at elevatedrails.com>
wrote:
> From: Mike Mangino <mmangino at elevatedrails.com>
> Subject: Re: [Facebooker-talk] Session Best Practices
> To: wthomas989 at yahoo.com
> Cc: facebooker-talk at rubyforge.org
> Date: Thursday, June 12, 2008, 4:02 PM
>
> You should use ensure_authenticated_to_facebook for all controllers
> that require status update. Also, reconstituting your sessions like
> that will stop working shortly. Sessions will expire in one hour.
>
> Mike
>
> On Jun 12, 2008, at 3:39 PM, William Thomas wrote:
>
> > Hi All- I am still trying to figure out the best way to handle
> > facebook session for my users. Here is my current flow:
> >
> > in my "external accounts controller"
> >
> > 1) before_filter :ensure_authenticated_to_facebook, :only =>
> > [:authenticate_facebook, :edit_facebook]
> >
> > 2) when the user links into facebook, facebooker authenticates and
> > redirects back to my
>  application
> >
> > 3) i detect the "auth_token" param in my method and store
the
> > session_key
> >
> > 4) now the session[:facebook_session] is good to go
> >
> > ....
> >
> > when a user logs in i detect if they have ever authorized facebook,
> > if they have a reconstitute a facebooker session :
> > session[:facebook_session] ||> >         returning
Facebooker::Session.create do |session|
> >           session.secure_with!(facebook.sessions_key,
> > facebook.fb_user_id, 1.day.from_now)
> >         end
> >
> > So... this all looks great. The problem is that when I add
> >
> > before_filter :ensure_has_status_update , :only =>
> > [:authenticate_facebook, :edit_facebook]
> > it always asks permission to do this - even when I confirm on
> > facebook , this before_filter thinks I don''t have
permission...
> >
> >
>  thoughts?
> >
> >
> > _______________________________________________
> > Facebooker-talk mailing list
> > Facebooker-talk at rubyforge.org
> > http://rubyforge.org/mailman/listinfo/facebooker-talk
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20080612/9c553006/attachment.html>