title: Client-side photo access with access_token, using Facebook graph
body: <p>I have an app that includes displaying some photos from a user's Facebook account. I'm currently using the fb_graph gem to do this (it's a Ruby project).</p>
  
  <p>I can get the URLs no problem, but what I can't work out is whether the users will be able to see these photos, displayed on my page, if they're logged out of their Facebook account. URLs look like: <code>http://sphotos-d.ak.fbcdn.net/hphotos-ak-prn1/&lt;id&gt;.jpg</code>.</p>
  
  <p>There's an obvious work around, though. I could append the access token I have for the user onto the URLs, so they have the same permissions to see the photos that I do: ``<a href="http://sphotos-d.ak.fbcdn.net/hphotos-ak-prn1/" rel="nofollow noreferrer">http://sphotos-d.ak.fbcdn.net/hphotos-ak-prn1/</a>.jpg?access_token=`.</p>
  
  <p>Questions like this one <a href="http://developers.facebook.com/docs/authentication/client-side/" rel="nofollow noreferrer">http://developers.facebook.com/docs/authentication/client-side/</a> suggest that it should be a last resort to use the <code>access_token</code> client-side, but I think I have to (as not all photos will be public).</p>
  
  <p>And this question <a href="https://stackoverflow.com/questions/9067947/facebook-access-token-server-side-vs-client-side-flows">Facebook access token: server-side vs client-side flows</a> says that because I'm getting the token server-side, it'll last for 60 days. So I want to be careful with how I use it.</p>
  
  <p>Two questions, then: will this work for viewing the photos, and is there a better way that doesn't expose the <code>access_token</code>?</p>