The code is invalid or expired. Session was clearly invalid using API call

Question

There is an ASP.NET 4.0 application that uses the Facebook API . It worked fine until last week. When I try to get an access token for my application

 public static string GetWebResponse_HttpWebRequest(string url) { HttpWebRequest request = WebRequest.Create(url) as HttpWebRequest; request.Method = "GET"; WebResponse webResponse; string response = ""; webResponse = request.GetResponse(); io.Stream stream = webResponse.GetResponseStream(); io.StreamReader str = new io.StreamReader(stream); response = str.ReadToEnd(); return response; } url: https://graph.facebook.com/oauth/access_token?client_id=117260348353246&client_secret=7b8734d7f36bf007d0d40bec728b57d9&code=AQD5xcdQiE2Ab9RpmexVUdP-i_2Nm5V52SVhxBVXkeq7WlJoOQ-xB4wYgbs3yeejLFHmR-lKLj0cwg6FeMWKGvHwT4akAlN7uMLxqu9YaqFumup3SPkuTjuQYETTCqQ1n2MAQjzexqiv8WV3UEcO4Qy5lObQ13qdYlKoYdKUacT42oJ0vhVuopH2WNkk3QRCq6DeAl02YU-sD8X8PTZgu52e&redirect_uri=http://www.opinere.com 

An error occurred:

 {"error":{"message":"Code was invalid or expired. The session was invalidated explicitly using an API call.","type":"OAuthException","code":100}} 

The application is working correctly on my local computer. On Windows Azure , this sometimes works, but mostly not.
What's wrong?

update: There are two requests: 1) without errors 2) and after a minute with an error - Code2 (access token) is empty And there seems to be a difference in the "HTTP_REFERER" header. The second request is missing.

Answer 1

Let me explain to you what is happening. This issue is related to multiple roles on the Internet.

What are azure web roles?

Web roles are VHD, i.e. system images that are actually copied with your data / website. His trick is to distribute, initialize, and copy.

How do web roles work?

A load balancer evenly distributes incoming traffic between roles. This means that a session created in one web role will be invalid in another. Its not just sessions, even forms authentication will not work.

Why?

Because session / form validation uses machineKey for encryption / hashing. And each web role / virtual machine has a different machineKey. Now you see why this works sometimes, and sometimes not. When the request reaches the same role of the VM that created the session, it works, and when not, no. In general, it will only work for 1: there are no role times for each session created (approximately).

Decision

As if you host your site in a web farm. Thus, you should see how to make your site run in a web farm. Or you can use only one web role if you use 2 small vm / role, instead you can use only one big virtual machine, but it all depends on how your application works, so you should first check what is best works, multiple virtual machines or a large VM. In addition, with one virtual machine you lose reliability, your site will be inaccessible if your role is reduced.

Look for a solution using table storage here http://www.intertech.com/Blog/Post/Session-State-in-Windows-Azure.aspx

EDIT Instead of saving the token in the session, use cookies, but you will not solve the fundamental problem, and you will encounter many problems if you do not do something with the main problem.