Spring Social Facebook：授权码换取AccessToken异常排查

Hey there! Let's break down why you're getting a null AccessToken when exchanging your Facebook auth code in your Spring Boot 1.4 app, and how to fix it.

The Root Cause #

From your debug details, the core issue boils down to how older versions of Spring Social handle Facebook's API response.

Facebook returns its access token data as JSON (e.g., {"access_token":"your-token","expires_in":3600,...}), but the default FacebookOAuth2Template in Spring Social versions matching Spring Boot 1.4 tries to parse this response as form-encoded (application/x-www-form-urlencoded).

This mismatch causes the entire JSON string to be treated as a single entry in the MultiValueMap—instead of splitting the response into key-value pairs like access_token and expires_in, it shoves the whole JSON into one map entry. That's why response.getFirst("access_token") returns null: the key doesn't exist in the parsed map at all!

The Fix: Custom OAuth2 Template #

To work around this, you'll need to create a custom FacebookOAuth2Template that properly parses the JSON response. Here's how:

1. Create the custom template class

import org.springframework.social.facebook.api.impl.FacebookOAuth2Template;
import org.springframework.social.oauth2.AccessGrant;
import org.springframework.util.MultiValueMap;
import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.IOException;
import java.util.Map;

public class CustomFacebookOAuth2Template extends FacebookOAuth2Template {

    public CustomFacebookOAuth2Template(String clientId, String clientSecret) {
        super(clientId, clientSecret);
    }

    @Override
    protected AccessGrant postForAccessGrant(String accessTokenUrl, MultiValueMap<String, String> parameters) {
        // Fetch the raw JSON response from Facebook
        String rawResponse = getRestTemplate().postForObject(accessTokenUrl, parameters, String.class);
        
        // Parse the JSON into a map using Jackson
        ObjectMapper objectMapper = new ObjectMapper();
        try {
            Map<String, Object> responseMap = objectMapper.readValue(
                rawResponse, 
                new TypeReference<Map<String, Object>>() {}
            );
            
            // Extract the required fields from the parsed map
            String accessToken = (String) responseMap.get("access_token");
            Long expiresIn = (Long) responseMap.get("expires_in");
            String refreshToken = (String) responseMap.get("refresh_token");
            
            // Build and return a valid AccessGrant
            return new AccessGrant(accessToken, null, refreshToken, expiresIn);
        } catch (IOException e) {
            throw new RuntimeException("Failed to parse Facebook access token response", e);
        }
    }
}

2. Use the custom template in your connection factory
   Replace the default OAuth operations in your FacebookConnectionFactory with your custom template:

FacebookConnectionFactory facebookConnectionFactory = new FacebookConnectionFactory(fbAppId, fbAppSecret);
// Override the default OAuth template with our custom one
facebookConnectionFactory.setOAuthOperations(new CustomFacebookOAuth2Template(fbAppId, fbAppSecret));

// Now exchange the auth code as before
AccessGrant accessGrant = facebookConnectionFactory.getOAuthOperations()
    .exchangeForAccess(authCode, redirectUri, null);

Why This Works #

By directly fetching and parsing the JSON response, we bypass the broken form-encoded parsing logic in the old Spring Social library. We explicitly extract the access_token, expires_in, and refresh_token fields from the JSON, then build a valid AccessGrant object with those values.

Quick Note on Dependencies #

Make sure your spring-social-facebook dependency is compatible with Spring Boot 1.4—version 1.1.1.RELEASE is a safe bet here. If you're using Maven, add this to your pom.xml:

<dependency>
    <groupId>org.springframework.social</groupId>
    <artifactId>spring-social-facebook</artifactId>
    <version>1.1.1.RELEASE</version>
</dependency>

内容的提问来源于stack exchange，提问作者amost