title: Facebook Server-side Authentication with Classic ASP
body: <p>Similar to <a href="https://stackoverflow.com/q/8653616/241201">this closed question</a> but I'll make mine more precise so hopefully there'll be an answer :)</p>
  
  <p>I'm adding Facebook login button to a website that's all in classic ASP, and I'm new to the Facebook SDK/API, and https ://developers.facebook.com/docs/authentication gives all its code examples in PHP. I need to pass some FB user info to server's database with some COM functions, so I'm going with server-side authentication. So far so good. Server-side auth doesn't give me the <strong>access token</strong> directly though it gives me a <strong>code</strong>, and I <em>mostly</em> understand the PHP example for how to turn that into the access token,</p>
  
  <pre><code>$token_url = "https://graph.facebook.com/oauth/access_token?"
     . "client_id=" . $app_id . "&amp;redirect_uri=" . urlencode($my_url)
     . "&amp;client_secret=" . $app_secret . "&amp;code=" . $code;
   $response = @file_get_contents($token_url);
   $params = null;
   parse_str($response, $params);
   $graph_url = "https://graph.facebook.com/me?access_token=" 
     . $params['access_token'];
   $user = json_decode(file_get_contents($graph_url));
  </code></pre>
  
  <p>I really don't know the ASP / VBScript way to do any of the above. PHP comes with so many more built-in functions than ASP like <code>urlencode</code>, <code>file_get_contents</code>, a <code>parse_str</code> that's smart enough to treat the string like query parameters, and I don't even know if I want or need anything like <code>json_decode</code> or not!</p>
  
  <p>For file_get_contents I am thinking of trying something like</p>
  
  <pre><code>fbApiCode = Request.QueryString("code")
      if len(fbApiCode) &gt; 0 then
          set xmlHttp = Server.CreateObject("Microsoft.XMLHTTP")
          appAuth = "https://graph.facebook.com/oauth/access_token?client_id=" &amp; _
             Application("fbAppId") &amp; "&amp;redirect_uri=" &amp; Application("fbRedirectUri") &amp; "&amp;client_secret=" _
             Application("fbAppSecret") &amp; "&amp;code=" &amp; fbApiCode
          xmlHttp.open("GET", appAuth, false) ' or post?
          accessResponse = xmlHttp.responseText
  </code></pre>
  
  <p>Is this even close to the right approach or am I running down a rabbit hole? If I can't translate the code to the access token with mere VBScript, I'll have to grab the FB user's info (name, email, etc.) in JavaScript with <code>FB.getLoginStatus()</code> and shoot that to my server with AJAX, which I know isn't terribly secure so I want to avoid resorting to that.</p>