服务器端身份验证和 Facebook 请求超时？
我的应用程序的一部分需要登录，并且无法使用 javascript 等进行客户端身份验证，因此使用 http 请求请求身份验证服务器端：
https://graph.facebook.com/oauth/access_token?client_id= [app_id]&client_secret=[secret]&redirect_uri=[uri]&code=[code]
这在大多数情况下都可以正常工作。但是，我间歇性地从该请求中得到超时/空响应。我可以运行一个工具，它会一遍又一遍地请求此页面，并且大约 80-90% 的时间会成功。一旦发生一个故障，任何用户的所有请求都会失败几秒钟，然后再次工作。
有没有其他人经历过类似的事情，或者你知道 Facebook 是否会在超过一定阈值时切断请求上限？我在文档中找不到任何听起来相似的信息。
Part of my app requires login and is not able to use client-side authentication with javascript etc, so requests authentication server-side using http request on:
https://graph.facebook.com/oauth/access_token?client_id=[app_id]&client_secret=[secret]&redirect_uri=[uri]&code=[code]
This works fine, most of the time. However I intermittently get timeout/null responses back from this request. I can run a tool which will request this page over and over, and will succeed about 80-90% of the time. As soon as one failure occurs, all requests fail, for any user, for a few seconds and then it works again.
Has anyone else experienced something like this, or do you know if there is a cap on requests which facebook will cut off over a certain threshold? I can't find any information that sounds similar in the documentation.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是因为，如果你发送太多请求，Facebook 会认为你想要进行 DDOS 攻击，并暂时阻止你的请求。
It is because if you send too much requests, facebook thinks you want to make a DDOS attack and block your requests for a while.
您必须在会话中仅检索一次令牌。换句话说，它肯定会让 FB 防御节流。
但是，如果您没有申请“offline_access”特殊权限，您的令牌就有过期时间。
默认值为retentionPeriod=2 和retentionUnit=hour。
也许您应该请求
您的许可，然后只检索用户令牌一次。
此外，
如果任何 API 调用因身份验证错误而失败，您需要执行重新询问令牌的操作。
You must retreive the token only once for your session. Other way it certainly turning FB defending against throtting.
However, if you're not apply for 'offline_access' special permission, your token has expiration time.
Default is retentionPeriod=2 and retentionUnit=hour.
maybe you should ask for
into your permission, then only retreive the user token once.
In addition you need to perform a
which is re-ask the token if any API call failed with authenticaion error.
在应用程序见解中，您可以从诊断页面检查 API 限制，还可以从性能页面检查最常见的错误。如果您没有看到任何错误或没有任何内容受到限制，您可能可以更改应用程序逻辑，如果收到超时/空响应，请再次请求令牌。
In app Insights, you can check API throtting from diagnostics page, and also most common errors from performance page. If you don't see any error or nothing been throttled, you could probably change the app logic, request the token again if you get timeout/null responses.