allow facebook responses to be in JSON or text/html when requesting a…

[daynejones]

Since Graph API v2.3, Facebook "fixed" their access_token endpoint. It no longer returns plaintext query strings but JSON. This issue came up during an update to facebook's graph api v2.8.

I'm using 4.3 so I assume that's the branch I should merge into.

[bdarnell]

Always submit PRs to master; if there is going to be a patch release to an older branch I'll deal with the cherry-picking then. (but it's very unlikely that there will be patch releases of older versions).

[bdarnell]

Is there any way to tell which version we're dealing with instead of a try/catch? Do they set the content-type header correctly?

And it's a server-side API, so do we even need to deal with the older version, or did the new version just replace it? It looks like version 2.3 reached its end-of-life today.

[bdarnell]

Use tornado.escape.json_decode (which will do the right thing on python 3)

[daynejones]

@bdarnell thanks for the help. I updated the pull request.

For posterity, here's the excerpt from Facebook's changelog:

[Oauth Access Token] Format - The response format of https://www.facebook.com/v2.3/oauth/access_token returned when you exchange a code for an access_token now return valid JSON instead of being URL encoded. The new format of this response is {"access_token": {TOKEN}, "token_type":{TYPE}, "expires_in":{TIME}}. We made this update to be compliant with section 5.1 of RFC 6749.

The changelog can be found here: https://developers.facebook.com/docs/apps/changelog

And to echo what you already said, according to that changelog, v2.2 has reached it's end of life as of today, March 25, 2017.

[bdarnell]

Thanks! I'll make a 4.4.3 release with this patch and make a new 4.5 beta.

[bdarnell]

@daynejones (or anyone else who's watching this issue) Would you mind weighing in on #2001? I don't use this API myself so I'd like to get another opinion on the significance of the expires_in field.