title: FacebookTokenError: This authorization code has been used
body: <p>Ok, so this is a common error with many causes. I am trying to modify an existing Node-Passport-Facebook module to have local images from the desktop uploaded to a users Facebook account after they log in. That is my goal. <br>This is the code module I am extending<br>
  <a href="https://github.com/passport/express-4.x-local-example" rel="nofollow">https://github.com/passport/express-4.x-local-example</a></p>
  
  <p>which in turn is based on
  <a href="https://github.com/jaredhanson/passport-facebook" rel="nofollow">https://github.com/jaredhanson/passport-facebook</a></p>
  
  <p>I never get past <strong><em>console.log('ERROR HERE..</em></strong>. with an error of <strong>"This authorization code has been used."</strong>  <br>
  What's confusing is that the auth code returned is ALWAYS DIFFERENT! so how could it already have been used when I try and exchange it for an access token?<br>
  Can anyone offer some suggestions, and or next steps I might try? My hunch is that there is something about Passport.js that is not implemented properly.<br>
  So my question is, how would I modify the code below (based on this passport facebook example) <a href="https://github.com/passport/express-4.x-facebook-example/blob/master/server.js" rel="nofollow">https://github.com/passport/express-4.x-facebook-example/blob/master/server.js</a><br>to upload an image after logging in?</p>
  
  <pre><code>var express = require('express');
  var passport = require('passport');
  var Strategy = require('passport-facebook').Strategy;
  
  var CLIENTSECRET ='&lt;client secret&gt;';
  
  var APPID ='&lt;app id&gt;';
  
  
  // Configure the Facebook strategy for use by Passport.
  //
  // OAuth 2.0-based strategies require a `verify` function which receives the
  // credential (`accessToken`) for accessing the Facebook API on the user's
  // behalf, along with the user's profile.  The function must invoke `cb`
  // with a user object, which will be set at `req.user` in route handlers after
  // authentication.
  passport.use(new Strategy({
  
      clientID: APPID,
      clientSecret: CLIENTSECRET,
      callbackURL: 'http://localhost:3000/login/facebook/return',
      enableProof: true
      //callbackURL: 'http://localhost:3000/login/facebook/return'
    },
    function(accessToken, refreshToken, profile, cb) {
      // In this example, the user's Facebook profile is supplied as the user
      // record.  In a production-quality application, the Facebook profile should
      // be associated with a user record in the application's database, which
      // allows for account linking and authentication with other identity
      // providers.
      cb(null, profile);
    }));
  
  
  // Configure Passport authenticated session persistence.
  //
  // In order to restore authentication state across HTTP requests, Passport needs
  // to serialize users into and deserialize users out of the session.  In a
  // production-quality application, this would typically be as simple as
  // supplying the user ID when serializing, and querying the user record by ID
  // from the database when deserializing.  However, due to the fact that this
  // example does not have a database, the complete Twitter profile is serialized
  // and deserialized.
  passport.serializeUser(function(user, cb) {
    cb(null, user);
  });
  
  passport.deserializeUser(function(obj, cb) {
      console.log(" ");
      console.log("ASSERT passport.deserializeUser being called");
      console.log(" ");
      cb(null, obj);
  });
  
  
  // Create a new Express application.
  var app = express();
  
  // Configure view engine to render EJS templates.
  app.set('views', __dirname + '/views');
  app.set('view engine', 'ejs');
  
  // Use application-level middleware for common functionality, including
  // logging, parsing, and session handling.
  app.use(require('morgan')('combined'));
  app.use(require('cookie-parser')());
  app.use(require('body-parser').urlencoded({ extended: true }));
  app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));
  
  // Initialize Passport and restore authentication state, if any, from the
  // session.
  app.use(passport.initialize());
  //app.use(passport.session());
  
  
  // Define routes.
  app.get('/',
    function(req, res) {
      res.render('home', { user: req.user });
    });
  
  app.get('/login',
    function(req, res){
      res.render('login');
    });
  
  app.get('/login/facebook',
    passport.authenticate('facebook'));
  
  app.get('/login/facebook/return', 
    passport.authenticate('facebook', { failureRedirect: '/login' }),
    function(req, res) {
  
      //my code changes start here!!
      var code = req.query.code;
  
      console.log("1 ASSERT after successful login! code="+code);
      if(req.query.error) {
          // user might have disallowed the app
          return res.send('login-error ' + req.query.error_description);
      } else if(!code) {
          return res.redirect('/');
      }
  
      var options={
          host:'graph.facebook.com',      
          path:'/oauth/access_token?client_id='+APPID+'&amp;code='+code +'&amp;client_secret='+CLIENTSECRET+'&amp;redirect_uri=http://localhost:3000/login/faceboo k/return'
      }       
      var https=require('https'); 
      https.get(options,function(res){
           res.setEncoding('utf8');       
           res.on('data', function (chunk) {
                  console.log('ERROR HERE'+chunk);
          });
      });    
  
  
      console.log("2  ASSERT after successful login!")
  
       //my code changes end here!!
  
  });
  
  app.get('/profile',
    require('connect-ensure-login').ensureLoggedIn(),
    function(req, res){
      res.render('profile', { user: req.user });
    });
  
  app.listen(3000);
  </code></pre>