Facebook – Get Facebook user’s profile picture prior to authenticating app

facebookfacebook-graph-apifacebook-javascript-sdk

Summary:

I am working on a website that connects to Facebook through the Graph API. I was asked whether I can get a user's profile picture if they are already logged into Facebook, but prior to the user authenticating the app. Is this possible?

EDIT:
I know you can get people's profile picture by going to http://graph.facebook.com/USERNAME_OR_USERID/picture?type=large, but would I be able to get a user's username or ID if they are logged into Facebook, but have not authorized my app?

Details:

According to the Facebook API User documentation, you can get their Facebook ID without an access_token, and I know if you go directly to a user's /me URL you can see their basic information. With the Facebook ID, I can grab their profile pic.

However, when I try to call it from the website using the following code, I get an OAuthException error.

FB.api('/me', function(response) {
    console.log(response);
});

I'm guessing that they have to authenticate the app, but I'm looking to see if I may have missed a way of getting their profile pic.

Thanks for your help!

Best Answer

You can get everyone's Facebook profile picture without authentication.

You just call http://graph.facebook.com/USERID/picture?type=large. This URL redirects you to image URL.

Edit: Querying by username is not allowed anymore, so I updated USERNAME_OR_USERID as USERID.

Related Solutions

Php – Facebook API – How to get a Facebook user’s profile image through the Facebook API (without requiring the user to “Allow” the application)

Simply fetch the data through this URL:

http://graph.facebook.com/userid_here/picture

Replace userid_here with id of the user you want to get the photo of. You can also use HTTPS as well.

You can use the PHP's file_get_contents function to read that URL and process the retrieved data.

Resource:

http://developers.facebook.com/docs/api

Note: In php.ini, you need to make sure that the OpenSSL extension is enabled to use thefile_get_contents function of PHP to read that URL.

Facebook – Getting the “real” Facebook profile picture URL from graph API

The first URL gives a HTTP 302 (temporary redirect) to the second. So, to find the second URL programatically, you could issue a HTTP request for the first URL and get the Location header of the response.

That said, don't rely on the second URL being pemanent. Reading a little in to the HTTP response code (of 302 as opposed to a permanent 301), it is possible Facebook changes those URLs on a regular basis to prevent people from—for example—using their servers to host images.

Edit: Notice that the CDN URL the OP posted is now a 404, so we know that we cannot rely on the URL being long-lived. Also, if you're linking to the Graph API from an <img> on a SSL-secured page, ~~there's a parameter you have to add~~ make sure you use https://graph.facebook.com.

Update: The API has added a parameter – redirect=false – which causes JSON to be returned rather than a redirect. The retruned JSON includes the CDN URL:

{
   "data": {
      "url": "http://profile.ak.fbcdn.net/...",
      "is_silhouette": false
   }
}

Again, I wouldn't rely on this CDN URL being long-lived. The JSON response is sent with permissive CORS headers, so you're free to do this client-side with XHR requests.

Related Topic