title: Facebook Graph API rejects newly created access token
body: <p>Earlier today, the Facebook login flow of our web application stopped working for some users. When we try to fetch the current profile, an error is returned. It claims that the access token we just generated by redirecting the user to the OAuth login flow has been rejected. </p>
  
  <p>The reason given is:</p>
  
  <blockquote>
    <p>The access token is invalid since the user hasn't engaged the app in longer than 90 days</p>
  </blockquote>
  
  <p>To me, this makes no sense since <em>we do not</em> store the access token anywhere except for the current session and recreate it every time the user logs in with Facebook.</p>
  
  <p>The stacktrace from Spring Social for the <code>GET /me</code> call looks like this:</p>
  
  <pre><code>ERR c.s.f.v.resource.AuthenticationResource Exception when connecting with Facebook
  org.springframework.social.RevokedAuthorizationException: The authorization has been revoked. Reason: The access token is invalid since the user hasn't engaged the app in longer than 90 days.
          at org.springframework.social.facebook.api.impl.FacebookErrorHandler.handleFacebookError(FacebookErrorHandler.java:85)
          at org.springframework.social.facebook.api.impl.FacebookErrorHandler.handleError(FacebookErrorHandler.java:59)
          at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63)
          at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:775)
          at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:728)
          at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:702)
          at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:350)
          at org.springframework.social.facebook.api.impl.FacebookTemplate.fetchObject(FacebookTemplate.java:220)
          at org.springframework.social.facebook.api.impl.FacebookTemplate.fetchObject(FacebookTemplate.java:215)
  </code></pre>
  
  <p>The issue is probably related to <a href="https://developers.facebook.com/blog/post/2018/04/09/user-access-token-changes" rel="noreferrer">changes in the Facebook API</a>, but I do not see how this affects the short lived access tokens we create on every login.</p>