New JS SDK with fallback OAuth 2.0 subdomain in fbsr_ cookie?

Question

EDIT: This error has been reported and confirmed as a Facebook error . Now it is fixed!

---

---

I am testing my updates to upgrade to the new JS SDK. My application works through several subdomains of my domain. On the old JDK, I called something like this:

FB.init({ appId: [APP_ID], status: false, cookie: true, xfbml: true }); FB.login(); 

In the new JDK, it looks like this:

 FB.init({ appId: [APP_ID], status: false, cookie: true, xfbml: true, oauth:true }); FB.login(); 

Using the FF cookie manager, you can see that the old version will set a cookie on mydomain.com, but the new one will set it on www.mydomain.com - this means that my other subdomain cannot access the cookie.

To clarify: the problem is that I cannot use the facebook cookie on different subdomains, and if I register them on each subdomain, I must also remove them from each subdomain

Answer 1

Update: The error has been updated by Facebook to "Fixed." Hooray!

This is a bug on facebook and has been registered, reproduced and accepted as a high priority here: https://developers.facebook.com/bugs/256155664428653?browse=search_4e843e6d89a232275456793

Answer 2

If you set oauth to true when you call FB.init () using the Javascript API, you will now get the cookie fbsr_APP_ID instead of the cookie fbs_APP_ID (note the “r”). It contains a signed request and part of the oauth migration.

If you use the PHP SDK, it should take care of this.

However, documents for websites are not updated with the new get_facebook_cookie () function: https://developers.facebook.com/docs/guides/web/

It still uses the old cookie format. You can find how to parse a signed request here:

http://developers.facebook.com/docs/authentication/signed_request/

Then you need to enable the "code" parameter in the cookie in the access_token through the documents: developers.facebook.com/docs/authentication/(no http: // due to StackOverflow spam prevention)

I dug in the source of the new PHP SDK a bit to figure this out, since all the documentation is not being updated.

The full code I use is a combination of the above with a few minor changes to work with the old or new cookie format. The new get_facebook_cookie () function returns several additional array elements (algorithm, code, issu_at, user_id), and several array elements are no longer set (base_domain, secret, session_key, sig). The main parameters that most people look for are most likely set (uid, access_token and expire)

 function get_facebook_cookie($app_id, $app_secret) { if ($_COOKIE['fbsr_' . $app_id] != '') { return get_new_facebook_cookie($app_id, $app_secret); } else { return get_old_facebook_cookie($app_id, $app_secret); } } function get_old_facebook_cookie($app_id, $app_secret) { $args = array(); parse_str(trim($_COOKIE['fbs_' . $app_id], '\\"'), $args); ksort($args); $payload = ''; foreach ($args as $key => $value) { if ($key != 'sig') { $payload .= $key . '=' . $value; } } if (md5($payload . $app_secret) != $args['sig']) { return array(); } return $args; } function get_new_facebook_cookie($app_id, $app_secret) { $signed_request = parse_signed_request($_COOKIE['fbsr_' . $app_id], $app_secret); // $signed_request should now have most of the old elements $signed_request[uid] = $signed_request[user_id]; // for compatibility if (!is_null($signed_request)) { // the cookie is valid/signed correctly // lets change "code" into an "access_token" $access_token_response = file_get_contents("https://graph.facebook.com/oauth/access_token?client_id=$app_id&redirect_uri=&client_secret=$app_secret&code=$signed_request[code]"); parse_str($access_token_response); $signed_request[access_token] = $access_token; $signed_request[expires] = time() + $expires; } return $signed_request; } 

Answer 3

1) Check your application. the domain in the settings is set as mydomain.com, not www.mydomain.com
2) Use the channel and url file in init:

 FB.init({ appId : [APP_ID], status : false, cookie : true, xfbml : true, channelUrl : document.location.protocol + "//domain.com/xd_receiver.html", oauth : true }); 

https://developers.facebook.com/docs/reference/javascript/FB.init/

hope this helps

Answer 4

check it out https://developers.facebook.com/apps/ <appid> / summary

look at the application domain: the "Basic Information:" part
if you specify "www.example.com" than it will only work on www.example.com. If you use "example.com", it will treat it as * .example.com and work for all subdomains