[Facebooker-talk] Session Best Practices

Mike Mangino
2008-06-12T21:02:52Z

You should use ensure_authenticated_to_facebook for all controllers
that require status update. Also, reconstituting your sessions like
that will stop working shortly. Sessions will expire in one hour.

Mike

On Jun 12, 2008, at 3:39 PM, William Thomas wrote:

> Hi All- I am still trying to figure out the best way to handle
> facebook session for my users. Here is my current flow:
>
> in my "external accounts controller"
>
> 1) before_filter :ensure_authenticated_to_facebook, :only =>
> [:authenticate_facebook, :edit_facebook]
>
> 2) when the user links into facebook, facebooker authenticates and
> redirects back to my application
>
> 3) i detect the "auth_token" param in my method and store the
> session_key
>
> 4) now the session[:facebook_session] is good to go
>
> ....
>
> when a user logs in i detect if they have ever authorized facebook,
> if they have a reconstitute a facebooker session :
> session[:facebook_session] ||>         returning
Facebooker::Session.create do |session|
>           session.secure_with!(facebook.sessions_key,
> facebook.fb_user_id, 1.day.from_now)
>         end
>
> So... this all looks great. The problem is that when I add
>
> before_filter :ensure_has_status_update , :only =>
> [:authenticate_facebook, :edit_facebook]
> it always asks permission to do this - even when I confirm on
> facebook , this before_filter thinks I don''t have permission...
>
> thoughts?
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk