restfb：用 java 编写一个 facebook 应用程序（使用新的图形 API）

restfb: Writing a facebook application with java (using the new graph api)

提问by ufk

I'm trying to write a facebook application using Java tomcat with RestFB.

我正在尝试使用 Java tomcat 和 RestFB 编写一个 facebook 应用程序。

the restfb documentation shows the following:

restfb 文档显示以下内容：

• Create a Facebook Application
• Request https://graph.facebook.com/oauth/authorize?client_id=MY_API_KEY&redirect_uri=http://www.facebook.com/connect/login_success.html& scope=publish_stream,offline_access,create_event
• Facebook will redirect you to http://www.facebook.com/connect/login_success.html? code=MY_VERIFICATION_CODE
• Request https://graph.facebook.com/oauth/access_token?client_id=MY_API_KEY&redirect_uri=http://www.facebook.com/connect/login_success.html& client_secret=MY_APP_SECRET&code=MY_VERIFICATION_CODE
• Facebook will respond with access_token=MY_ACCESS_TOKEN

• 创建 Facebook 应用程序
• 请求https://graph.facebook.com/oauth/authorize?client_id=MY_API_KEY&redirect_uri=http://www.facebook.com/connect/login_success.html& scope=publish_stream,offline_access,create_event
• Facebook 会将您重定向到http://www.facebook.com/connect/login_success.html吗？代码=MY_VERIFICATION_CODE
• 请求https://graph.facebook.com/oauth/access_token?client_id=MY_API_KEY&redirect_uri=http://www.facebook.com/connect/login_success.html& client_secret=MY_APP_SECRET&code=MY_VERIFICATION_CODE
• Facebook 将响应 access_token=MY_ACCESS_TOKEN

I think that i may be looking at the wrong instructions and this is for a facebook connect or anything else besides an actual facebook application inside apps.facebook.com/app_name.

我认为我可能正在查看错误的说明，这是针对 facebook 连接或除 apps.facebook.com/app_name 中的实际 facebook 应用程序之外的任何其他内容。

I would really appreciate any relevant information regarding the issue. I'm simply trying to create a simple facebook application that prints the name of the user.

我非常感谢有关该问题的任何相关信息。我只是想创建一个简单的 facebook 应用程序来打印用户的姓名。

In general after I fetch the acces token of the user i can do the following:

一般来说，在我获取用户的访问令牌后，我可以执行以下操作：

FacebookClient facebookClient = new DefaultFacebookClient(MY_ACCESS_TOKEN);
User user = facebookClient.fetchObject("me", User.class);
out.println("User name: " + user.getName());

My problem is how do i properly fetch the access token of the user? in the information i showed at the top of the post, it shows that i need to make 2 requests. the first for the code and the other for the acess token. and the request for the access token actually reveals my app secret key to the user because each time i forward him to a different page the user can easily view the get and set parameters.

我的问题是如何正确获取用户的访问令牌？在我在帖子顶部显示的信息中，它表明我需要提出 2 个请求。第一个用于代码，另一个用于访问令牌。并且对访问令牌的请求实际上向用户显示了我的应用程序密钥，因为每次我将他转发到不同的页面时，用户都可以轻松查看获取和设置参数。

so i guess i'm pretty lost here.

所以我想我在这里迷路了。

please help! :)

请帮忙！:)

thanks

谢谢

update after comments

评论后更新

with these instructions i need two times to redirect the user's page. first to get the code and then to get the access token. the user can see these two redirections and because of that he can easily see the facebook application key and secret key from the get parameters. how do i make sure that these steps are hidden from the user?

根据这些说明，我需要两次重定向用户页面。首先获取代码，然后获取访问令牌。用户可以看到这两个重定向，因此他可以轻松地从 get 参数中看到 facebook 应用程序密钥和秘密密钥。我如何确保这些步骤对用户隐藏？

回答by Kris Babic

As stated in the comments, these are the steps you need to take to access Facebook's graph API. However, to answer your second question:

正如评论中所述，这些是访问 Facebook 图形 API 所需的步骤。但是，要回答您的第二个问题：

"How do I make sure that these steps are hidden from the user?"

“我如何确保对用户隐藏这些步骤？”

Only the first request should be performed by the user's browser. The purpose being that Facebook wants to make sure it is the sole authorization provide for the user's Facebook identity. Depending on the application you are writing, you would either use the redirect URL to point to the default redirect URL that you specified, or specify a custom url on your website that you will use to retrieve the token. The first approach is typically used by stand-alone applications such as mobile devices that can control how the browser handles redirects. The second approach would be used for a custom web-based application. Once you receive the access token, then you would perform the second operation within your code (using your favorite http apis) and not through the browser. The redirect on the access_token url is compared against the redirect url specified on the authentication-url. Facebook uses it for validation only and does not perform an actual redirect on the successful completion of the request.

只有第一个请求应该由用户的浏览器执行。Facebook 的目的是确保它是用户 Facebook 身份的唯一授权。根据您正在编写的应用程序，您可以使用重定向 URL 指向您指定的默认重定向 URL，或者在您的网站上指定一个自定义 URL，您将使用该 URL 来检索令牌。第一种方法通常由独立应用程序使用，例如可以控制浏览器如何处理重定向的移动设备。第二种方法将用于自定义的基于 Web 的应用程序。收到访问令牌后，您将在代码中执行第二个操作（使用您最喜欢的 http api），而不是通过浏览器。access_token url 上的重定向与 authentication-url 上指定的重定向 url 进行比较。Facebook 仅将其用于验证，并不会在请求成功完成时执行实际重定向。

Here are the high-level steps:

以下是高级步骤：

1. Redirect user's browser to the authentication-url specifying the appropriate redirect_uri
2. Retrieve verification token from redirected browser request
3. Perform access_token retrieval using your preferred HTTP framework (no user input required)
4. Parse results and retrieve access token
5. Initial restfb with token and use as needed

1. 将用户的浏览器重定向到指定适当的 redirect_uri 的 authentication-url
2. 从重定向的浏览器请求中检索验证令牌
3. 使用您首选的 HTTP 框架执行 access_token 检索（无需用户输入）
4. 解析结果并检索访问令牌
5. 带有令牌的初始 restfb 并根据需要使用

回答by Lincoln

The REST API has been deprecated. You should look in to the JavaScript and Graph APIs instead - there is a good article on this here: http://ocpsoft.org/opensource/creating-a-facebook-app-setup-and-tool-installation/(Three part series, very detailed :)

REST API 已被弃用。你应该查看 JavaScript 和 Graph APIs - 这里有一篇很好的文章：http: //ocpsoft.org/opensource/creating-a-facebook-app-setup-and-tool-installation/（三部分系列，很详细:)