[Facebooker-talk] Session Best Practices

William Thomas
2008-06-12T22:32:07Z

Wow fast responses, awesome!

The session reconstitution won''t work for much longer is because of the
change in the Facebook API policy, correct? What will be the new way to store
this, if any ? I have heard that you can still get the user to voluntarily allow
the session key to never expire.

I still have the issue with "update status" - facebooker
doesn''t think it is enabled when it really is.

As for the ensure_authenticated_to_facebook being controller wide - is that a
good practice or will it cause me problems later on?

--- On Thu, 6/12/08, Mike Mangino &lt;mmangino at elevatedrails.com&gt;
wrote:
From: Mike Mangino &lt;mmangino at elevatedrails.com&gt;
Subject: Re: [Facebooker-talk] Session Best Practices
To: wthomas989 at yahoo.com
Cc: facebooker-talk at rubyforge.org
Date: Thursday, June 12, 2008, 4:02 PM

You should use ensure_authenticated_to_facebook for all controllers
that require status update. Also, reconstituting your sessions like
that will stop working shortly. Sessions will expire in one hour.

Mike

On Jun 12, 2008, at 3:39 PM, William Thomas wrote:

&gt; Hi All- I am still trying to figure out the best way to handle
&gt; facebook session for my users. Here is my current flow:
&gt;
&gt; in my "external accounts controller"
&gt;
&gt; 1) before_filter :ensure_authenticated_to_facebook, :only =&gt;
&gt; [:authenticate_facebook, :edit_facebook]
&gt;
&gt; 2) when the user links into facebook, facebooker authenticates and
&gt; redirects back to my application
&gt;
&gt; 3) i detect the "auth_token" param in my method and store the
&gt; session_key
&gt;
&gt; 4) now the session[:facebook_session] is good to go
&gt;
&gt; ....
&gt;
&gt; when a user logs in i detect if they have ever authorized facebook,
&gt; if they have a reconstitute a facebooker session :
&gt; session[:facebook_session] ||&gt;         returning
Facebooker::Session.create do |session|
&gt;           session.secure_with!(facebook.sessions_key,
&gt; facebook.fb_user_id, 1.day.from_now)
&gt;         end
&gt;
&gt; So... this all looks great. The problem is that when I add
&gt;
&gt; before_filter :ensure_has_status_update , :only =&gt;
&gt; [:authenticate_facebook, :edit_facebook]
&gt; it always asks permission to do this - even when I confirm on
&gt; facebook , this before_filter thinks I don''t have
permission...
&gt;
&gt; thoughts?
&gt;
&gt;
&gt; _______________________________________________
&gt; Facebooker-talk mailing list
&gt; Facebooker-talk at rubyforge.org
&gt; http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20080612/d4d5b805/attachment-0001.html>