FB Graph API Response Paging Next contains access_token

Question

Now I am working with Graph API 3.2.

Is there any opportunities to configure within my request went to Graph API to not get back the access token in the end of the response param, called Paging Next?

i.e: here is the documentation. I just don't want to get back the access token as a plain text in the repsonse, like here:

  "feed": {
    "data": [
      {
        "created_time": "2017-12-12T01:24:21+0000",
        "message": "This picture of my grandson with Santa",
        "id": "{your-user-id}_1809387339093972"       // Post ID
      },
      {
        "created_time": "2017-12-11T23:40:17+0000",
        "message": ":)",
        "id": "{your-user-id}_1809316002434439"       // Post ID
      },
      {
        "created_time": "2017-12-11T23:31:38+0000",
        "message": "Thought you might enjoy this.",
        "id": "{your-user-id}_1809310929101613"       // Post ID
      }
    ],
    "paging": {
      "previous": "https://graph.facebook.com/v3.2/{your-user-id}/feed?format=json&limit=3&since=1542820440&access_token={your-user-access-token}&__paging_token=enc_AdCgj6RSGWTYV7EXj2cFlOWJjbZCq8oI3ogIpLrxPCVK3U8Kad0EgsZA2vri3YKIwl71XGRDJz9C8TgqMeyiu8U5CD&__previous=1",
      "next": "https://graph.facebook.com/v3.2/{your-user-id}/feed?format=json&limit=3&access_token={your-user-access-token}&until=1542583212&__paging_token=enc_AdDLmzUgWiLo6oHGCI53S5begiKOfNZBY0affrLMWgheBzfwMA7XSKmgjyNbuZBIptdXc18j1Se0Dm7vEsePh1SoM3"
    }
  },
  "id": "{your-user-id}"
}

Thanks anyway!! :)

Why? Those URLs are supposed to be usable directly as they are given to make the next request, and that means they need to include an access token. If you are exposing this “private” API response to someone else, then you will have to filter it yourself to not leak such information. — 04FS, May 29 '19 at 13:09
We are implementing a proxy service, but I was afraid of the answer that you gave. :/ Then I am going to implement a zuul postfilter. Thanks for answering! @04FS — lombocska, May 29 '19 at 16:34

score 1 · Accepted Answer · answered Dec 15 '21 at 12:08

It is answered elsewhere: https://stackoverflow.com/a/29900228 but it is good to have a reference to that answer here, too.

The solution that worked for me with various Graph API versions is to pass the token in the Authorization header:

return requests.get(url,
                    headers={'Authorization': 'Bearer ' + token})

If the token travels in the header, it won't appear in the response anywhere.

FB Graph API Response Paging Next contains access_token

1 Answers1