Take the 2-minute tour ×

I am trying to build an google chrome extension for Facebook.

I should be able to access the facebook api without actually asking the user to authenticate explicitly for my extension.

Is there a way to do that?

share|improve this question
What information you want to retrieve from the user's facebook? With the user's id, you can read as much as they allow you through the Graph API: graph.facebook.com/cocacola –  jjperezaguinaga Dec 28 '12 at 15:51
I want to get all the posts that the user has ever made (public or non public). –  Tushar Dec 28 '12 at 16:12
@TusharMathur: Are you asking to fetch user details without any sort of authentication? –  Sudarshan Jan 9 '13 at 10:36
@Sudarshan. Since it would be an extension all the requests would be authenticated by the logged in user. –  Tushar Jan 9 '13 at 11:40
@TusharMathur: Then you can achieve this without any added authentication as you expected –  Sudarshan Jan 9 '13 at 11:45

1 Answer 1

The answer is yes and no.

Yes: You can "read" as much as a they have loaded in their page through a Content Script that reads the window document. A good example could be the following.

In the manifest.json

"content_scripts" : [{
  "matches" : ["http://www.facebook.com/*"],    
  "js" : ["js/vendor/jquery.min.js", "js/content.js"],
  "run_at" : "document_end"

In the js/content.js

var document = jQuery(window.document);
var posts = document.find("div[role='article']");

and then you can read as much as you wish of the user, or well, as much as the page loads. You could have some sort of timeout mechanism that checks whether there's new content in the page, or new elements were added to the dom, but at the end the user has to scroll down to load information, or you can hack this through Javascript.

No (and why you shouldn't): I'm not a legal guy, but I had been developing long enough to know that whenever a platform gives you an API, you are supposed to use it. Why? Because they can control what information you are reading, and they can protect their user information that way.

This is actually a delicate line, because sometimes you can enhance a website experience without necessary using a website API (and sometimes they don't even have one). This is then even appreciated if you are actually improving the user experience. In this case thought, I wouldn't do it though, because:

  • It's Facebook, I'm pretty sure they have in some Terms of Service a line where they describe what I just wrote about reading user's information through external scripts.
  • External applications that crawl your data have had bad reputation since day one (automatic posts, scamming, scrapping information, etc)
  • Facebook API is now based in Oauth2, which in its foundation was made to protect the users; through a token denial, a user can stop at any time an application from reading his/her data, while your application has no mechanism for that (uninstall may be it, but you may have stored already his/her data)
  • It's not that hard asking for permission and you would be saving yourself a lot of trouble.

How to do it the right way? Request an application ID, and load the facebook SDK in a Background Page. Prompt the user permissions (yes, the right way includes asking the user for permission on what you can read so he/she can deny you access to them if you misbehave) and then query the Facebook API with that.

Think about it. You can create an extension that reads the content of a user page whenever he logs into his/her bank. Or his email. Actually, anything that a user sees inside a browser window can be retrieved by an extension. This is extremely dangerous to the user if there's no control over which information is being taken from him!

Ask for permission first. Don't be THAT guy ;)

share|improve this answer
I really appreciate the effort you have put in to explain the logical aspect of asking for permission from a user. As far as the question is concerned, if we do not ask for permission using the api we would get only the data which is visible on the page. Thus a more precise answer I think would be NO. –  Tushar Dec 28 '12 at 17:47
Agreed, although you should refrain to your question: you asked if there was a way to do that, and as I described in the "Yes" section, there is indeed. If the user never logs in Facebook.com, then as you state in your comment correctly, then a precise answer is No. –  jjperezaguinaga Dec 28 '12 at 20:01

Your Answer


