diff --git a/docs/releases/next.rst b/docs/releases/next.rst
index 597b1077..424fbb98 100644
--- a/docs/releases/next.rst
+++ b/docs/releases/next.rst
@@ -18,8 +18,11 @@ Multiple modules
 `tornado.auth`
 ~~~~~~~~~~~~~~
 
-* `tornado.auth.OAuthMixin` always sends ``oauth_version=1.0`` in its
+* `~tornado.auth.OAuthMixin` always sends ``oauth_version=1.0`` in its
   request as required by the spec.
+* `~tornado.auth.FacebookGraphMixin` now uses ``self._FACEBOOK_BASE_URL``
+  in `~.FacebookGraphMixin.facebook_request` to allow the base url to be
+  overridden.
 
 `tornado.escape`
 ~~~~~~~~~~~~~~~~
diff --git a/tornado/auth.py b/tornado/auth.py
index ded1821b..f1856b1e 100644
--- a/tornado/auth.py
+++ b/tornado/auth.py
@@ -1095,6 +1095,7 @@ class FacebookGraphMixin(OAuth2Mixin):
     _OAUTH_ACCESS_TOKEN_URL = "https://graph.facebook.com/oauth/access_token?"
     _OAUTH_AUTHORIZE_URL = "https://graph.facebook.com/oauth/authorize?"
     _OAUTH_NO_CALLBACKS = False
+    _FACEBOOK_BASE_URL = "https://graph.facebook.com"
 
     @_auth_return_future
     def get_authenticated_user(self, redirect_uri, client_id, client_secret,
@@ -1205,7 +1206,7 @@ class FacebookGraphMixin(OAuth2Mixin):
                         return
                     self.finish("Posted a message!")
         """
-        url = "https://graph.facebook.com" + path
+        url = self._FACEBOOK_BASE_URL + path
         all_args = {}
         if access_token:
             all_args["access_token"] = access_token