User Skips Permission in Facebook Auth Dialogue Javascript SDK

facebook, facebook-authentication, facebook-graph-api, facebook-javascript-sdk

Solution

You need to check explicitly for the permission before proceeding. If they haven't provided the necessarily permissions, you need to display `FB.login()` with the necessary scope again.

Here is the code for checking permissions:

FB.api('/me/permissions', function (response) {
            var perms = response.data[0];
            // Check for publish_stream permission in this case....
            if (perms.publish_stream) {                
                // User has permission
            } else {                
                // User DOESN'T have permission. Perhaps ask for them again with FB.login?
            }                                            
    } );

Problem

I have an app in a page tab that uses the facebook javascript sdk. When a new user comes to the app, I get the expected "Log in with facebook" pop-up. I also have some extended permissions that I've put in the scope parameter of FB.Login. After the users logs in with facebook I see the expected extended permissions pop-up. The only problem is if the user skips the extended permissions, the dialogue returns back an access_token, but it's not valid for the extended permissions. Code example below. ``` window.fbAsyncInit = function () { FB.Canvas.setAutoGrow(); FB.init({ appId: facebookAppId, status: true, // check login status }); function updateFBInfo(response) { console.log('updateResp:'); if (response.authResponse) { //user is already logged in and connected FB.api('/me', function (info) { displayUserInfo(info, response); }); } else { FB.login(function (loginResponse) { if (loginResponse.authResponse) { FB.api('/me', function (info) { displayUserInfo(info, loginResponse); }); } }, { scope: 'email,manage_pages,offline_access,publish_stream' }); } } FB.getLoginStatus(updateFBInfo); }; ``` I guess my question is either, what am I missing (this has got to be something easy), or is there a way to check and see if the returned acces_token is actually valid?

Original source