Session invalidated because user changed password

Question

The implementation of the PhoneGap application for Android and iOS, the application uses Facebook Connect and PhoneGap Facebook Connect Plugin ( https://github.com/davejohnson/phonegap-plugin-facebook-connect ). A few days ago I had a problem with access_token, but only on Android, the same script works on iOS without problems. Step by step:

• Initiate facebook. (using plugins function)
• Log in to facebook. (using the plugin function) (requesting permissions: "email user_birthday publish_stream offline_access")
• Make an api / my call using the returned token.

Step 3 returns an error, and when I take the URL and put it in the desktop browser, it gives me the error "The session was invalid because the user changed the password."

The sandbox / non-sandbox app does not make any difference.

Exactly the same steps in iOS work fine.

I saw a lot of questions about SOF and facebook about this, but they all refer to letting the user perform the authentication flow again or solve the problem in a few days ... Is there anyone who can confirm that this is really a facebook error ? Or is there a solution? Or can it explain why it works on Android and not iOS? Maybe this could be connected with me in iOS, not using the facebook application, but preferring to always go through OAuth in the browser?

Thanks for any tips!

EDIT:

Other related issues have been discovered that seem to have the same root cause as mine.

How to remove all potentially cached tokens or session IDs on Android?

Instant access token

Answer 1

Well, in the end I found out that the main reason for my problem was that the Android and iOS facebook SDKs handle offline_access differently in the value they set in the "expires" parameter in the session object.

On iOS "expires", dating will be set far in the future (4001-01-01), and on Android "expires" will be set to 0. This made my comparison (expired <today) fail (I did the date syntax in milliseconds), and the session has always been "invalid."

(then in my case I always did logout if the session was invalid, which made my token incorrect for real when I tried it in the browser afterwards .. doh ..)