0

I am adding Facebook login to my CodeIgniter app (I am integrating into FB as a canvas app) by using the code presented here. The app isn't open to the public yet, I am testing it with my own account (which has the "administrator" role for the app on FB).

The problem is, I am not getting the user ID back from the following code. In fact, I'm only getting a small portion of the data I should be getting.

Here is the relevant part of the code (found in libraries/facebook.php on the Git page above):

public function getSignedRequest() {
    if (!$this->signedRequest) {
      if ($this->allowSignedRequest && !empty($_REQUEST['signed_request'])) {  //this condition is true
        $this->signedRequest = $this->parseSignedRequest(
          $_REQUEST['signed_request']    //long random-looking string, 180 characters
        );
      } else if (!empty($_COOKIE[$this->getSignedRequestCookieName()])) {
        $this->signedRequest = $this->parseSignedRequest(
          $_COOKIE[$this->getSignedRequestCookieName()]);
      }
    }
    return $this->signedRequest;
  }

The function above returns this:

array(3) { ["algorithm"]=> string(11) "HMAC-SHA256" ["issued_at"]=> int(1402224646) ["user"]=> array(3) { ["country"]=> string(2) "rs" ["locale"]=> string(5) "en_US" ["age"]=> array(1) { ["min"]=> int(21) } } } 

Even though it's supposed to return something like this according to the docs:

{
  "algorithm": "HMAC-SHA256",
  "expires": 1317243600,
  "issued_at": 1317239909,
  "oauth_token": "<token>",
  "page": {
    "id": "<id>",
    "liked": false,
    "admin": true
  },
  "user": {
    "country": "in",
    "locale": "en_GB",
    "age": {
      "min": 21
    }
  },
  "user_id": "<user-id>"
}

So the stuff that's missing is user_id, page, expires and oauth_token.

This is the parseSignedRequest function:

protected function parseSignedRequest($signed_request) {

    if (!$signed_request || strpos($signed_request, '.') === false) {
        self::errorLog('Signed request was invalid!');
        return null;
    }

    list($encoded_sig, $payload) = explode('.', $signed_request, 2);

    // decode the data
    $sig = self::base64UrlDecode($encoded_sig);
    $data = json_decode(self::base64UrlDecode($payload), true);var_dump($data);

    if (!isset($data['algorithm'])
        || strtoupper($data['algorithm']) !==  self::SIGNED_REQUEST_ALGORITHM
    ) {
      self::errorLog(
        'Unknown algorithm. Expected ' . self::SIGNED_REQUEST_ALGORITHM);
      return null;
    }

    // check sig
    $expected_sig = hash_hmac('sha256', $payload,
                              $this->getAppSecret(), $raw = true);

    if (strlen($expected_sig) !== strlen($sig)) {
      self::errorLog('Bad Signed JSON signature!');
      return null;
    }

    $result = 0;
    for ($i = 0; $i < strlen($expected_sig); $i++) {
      $result |= ord($expected_sig[$i]) ^ ord($sig[$i]);
    }

    if ($result == 0) {
      return $data;
    } else {
      self::errorLog('Bad Signed JSON signature!');
      return null;
    }
  }

I get the exact same response whether I try with my own account (administrator role) or a friend's account (tester role). If I try a third account (no role at all) then Facebook correctly says the page isn't available (because the app is closed to the public).

Can anyone see the problem?

1 Answer 1

1

Obviously, there will be no Page data on a Canvas App (because there is no Page).

About the User-ID: Of course you have to implement user authorization, or you will not get ANY ID. I don´t see any user authorization in your code. Without authorization, the user will be completely anonymous. You can implement authorization with JavaScript or PHP, for example. Here are some resources:

Keep in mind that you will not get the real User ID anymore, but only an "App Scoped ID". See the following Facebook resources for more information:

5
  • But the demo of the GitHub page (link in question) works completely - the authorization dialog comes up when you click 'log in with Facebook' and then you can log into the app. Jun 8, 2014 at 16:37
  • what exactly works in the demo? there can be no page parameter if you are not on a page, for example. that is a fact. and does the dialog come up in your app too? and i don´t see any sign of usage of the signed_request parameter in that example code. i highly suggest NOT relying on the signed_request parameter for getting the user id.
    – andyrandy
    Jun 8, 2014 at 18:39
  • What works is - when I click the login button, I log into the site with my own facebook account, which would imply that it gathers my Facebook ID correctly. Jun 8, 2014 at 18:44
  • please read my whole answer again, especially the part with the app scoped id. do not rely on the signed_request parameter for the user id, that is the worst place to get it.
    – andyrandy
    Jun 8, 2014 at 19:21
  • btw, getSignedRequest is an integral part of the facebook php sdk and it is not used in the code example.
    – andyrandy
    Jun 8, 2014 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.