Facebook user deactivates application

Question

when the user accepts the facebook application from my website, I save the user data and facebook data (access token) in the database.

when it removes my application from facebook, I want to remove the part from the database. how to do it?

I can assign a Deverthorize Callback URL. if someone uninstalls the application, he will redirect this page. but, wt should be the code here to remove data from db? I mean, when redirecting, it will publish access token data so that I can charge the access token and delete this line.

Answer 1

This is clearly stated in the document:

Application deauthorization

When a user of your application removes it in the application panel or blocks the application in News Feed, your application can be notified by specifying the Deauthorize callback URL in the application of the developer. During the removal of the application, we will send an HTTP POST request containing one parameter, signed_request, which contains the user ID (UID) of the user who simply deleted your application. You will not receive the user's access token in this request, and all existing user access tokens will automatically expire.

Thus, using the signed_request function in its own document:

 <?php function parse_signed_request($signed_request, $secret) { list($encoded_sig, $payload) = explode('.', $signed_request, 2); // decode the data $sig = base64_url_decode($encoded_sig); $data = json_decode(base64_url_decode($payload), true); if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') { error_log('Unknown algorithm. Expected HMAC-SHA256'); return null; } // check sig $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true); if ($sig !== $expected_sig) { error_log('Bad Signed JSON signature!'); return null; } return $data; } function base64_url_decode($input) { return base64_decode(strtr($input, '-_', '+/')); } $result = parse_signed_request($_REQUEST['signed_request'],"APP_SECRET"); $myFile = "deauthorize.txt"; $fh = fopen($myFile, 'w') or die("can't open file"); fwrite($fh, $result["user_id"] . "\n"); fclose($fh); ?> 

So, all you have to do is get the $result["user_id"] request from your database and delete the record.

PS: I would recommend adding a new field called active and just disconnecting the user, rather than deleting the record together.

EDIT:
Facebook does not redirect the user to an authorization URL! he will ping only:

Facebook links to this URL when a user deactivates your application

Answer 2

This code does not work, although it is called when the user deauthorizes the application. The only data passed to the function is "1" (tested with a test user and my own FB account when the application is active)

file_put_contents ("test.txt", $ fbUserId. "". print_r ($ _ REQUEST ['signed_request']));

in test.txt file "1"