Facebook requires access_token for user picture

[poblabs]

I'm not sure if this is a trivial thing to update but as of September 2020, it looks like Facebook requires an access_token to reach the user picture of a profile.

Any thoughts on how to update to this new method?

---

https://developers.facebook.com/docs/graph-api/reference/user/picture/

[pkoenig10]

Unfortunately, when using an access token, Facebook prevents accessing information about users who have not also authorized the application. This means that you would only be able to access profile pictures for users who are using the same application to obtain access tokens.

I'm not going to create an application and embed the client ID and client secret in Sink because it would allow anyone to obtain access tokens for the application and thus could easily be abused. I specifically stopped doing this with the Google client ID and client secret in 99268ba. So, because each user would need to create their own application, in all likelihood Sink would only be able to access your own profile information.

The only way to continue supporting the ability to fetch profile pictures is to scrape them. However, the mbasic site only provides very low resolution profile pictures (the largest size I can seem to get is 320 x 320), so I would have to scrape the main site. But the scraping the main site is significantly more difficult because:

• It requires Javascript, meaning I would have run a headless browser.
• Even with Javascript, the HTML is fairly well obfuscated, making it difficult to reliably find the profile picture URL.

Over the last 5 years Facebook has been increasingly locking down API access to prevent abuse by applications that attempt to mine data by trawling through connections of a relatively small number of users that have authorized the application (ex. Cambridge Analytica). The recent addition of rate limits (see #27) are yet another example. Unfortunately, this makes it difficult for end users to programmatically access data they can see on Facebook using tools like Sink.

Given these limitations, as well as my decreasing interest in and use of this project, it's unlikely that I will provide any further improvements or fixes to Sink. You are more than welcome to fork this project and I am more than happy to accept contributions, but I probably won't be doing any proactive work.

[poblabs]

No worries - I've actually been using your code and created a fork of it. I was able to create a Facebook app, get my own user access_token, and I'm able to get everyone's photo that's needed. The token is only good for 60 days, so I'll have to re-do this every so often, but shouldn't be too much of a hassle. Their graph explorer makes it easy to create a new long term token.

I tried scraping, but you're right - too low res. Which is why I spent the time to get the FB app working.

I don't think a PR would be nice - my code on this project is way too messy for the public to see 😄

Thanks again for the foundation of code for me to add on top of!