title: Does it make sense to store Facebook access tokens in the database?
body: <p>I recently had to integrate Facebook authentication into an existing application, having its own notion of a User. I created a separate class, called FacebookAccount, which is connected to a particular user within my system.</p>
  
  <p>I was initially saving the access tokens, and checking against them, rather than the Facebook id. Then, I realized by accident how unreliable access tokens actually are. They change over time, while the Facebook id is supposed to always stays the same.</p>
  
  <p>Here comes the question - should I even care about storing the access tokens? If they are really transient, like, some sort of session ids, changing every now and, it makes no sense to store them at all, right? All I need would be the Facebook id. I will simply keep the access token in the browser session</p>