15

I'm trying to set up my (iframe) Facebook application to use OAuth for authentication. I used the python-sdk from Facebook, but I'm not really satisfied by the result, yet.

The problem is that when I redirect a user that never accessed my application to the login page, my iframe diplays an ugly intermediate page, such as the following one:

The page I'm getting

If the user clicks on "Go to Facebook.com" link, she is then redirected to the standard "Request for Permission" page.

Standard Request for Permission page

Is there any way to avoid the first page and lead the user straight to the second one?

This problem happens on the first access for users that haven't granted any permission to my application yet.

The login code is based on the OAuth example in the Python SDK:

class LoginHandler(BaseHandler):
    def get(self):
        verification_code = self.request.get("code")
        args = dict(client_id=FACEBOOK_APP_ID, redirect_uri=self.request.path_url)
        if self.request.get("code"):
            args["client_secret"] = FACEBOOK_APP_SECRET
            args["code"] = self.request.get("code")
            raw_response = urllib.urlopen(
                "https://graph.facebook.com/oauth/access_token?" +
                urllib.urlencode(args)).read()
            logging.debug("access_token raw response " + raw_response)
            response = cgi.parse_qs(raw_response)
            access_token = response["access_token"][-1]

            # Download the user profile and cache a local instance of the
            # basic profile info
            graph = facebook.GraphAPI(access_token)
            profile = graph.get_object("me")

            user = User.get_by_key_name(profile["id"])
            if not user:
                user = User(key_name=str(profile["id"]),
                                id=str(profile["id"]),
                                name=profile["name"],
                                firstname=profile["first_name"],
                                profile_url=profile["link"],
                                access_token=access_token)
                user.put()
            elif user.access_token != access_token:
                # we already know this user, but we need to update
                user.access_token = access_token
                user.put()

            set_cookie(self.response, "fb_user", str(profile["id"]),
                       expires=time.time() + 30 * 86400)

            self.response.headers["P3P"] = 'CP="IDC CURa ADMa OUR IND PHY ONL COM STA"'
            self.redirect("/")
        else:
            self.redirect(
                "https://graph.facebook.com/oauth/authorize?" +
                urllib.urlencode(args))
2
  • Does the first page show up if you are actually logged to Facebook? From my experience, the behavior is very different depending on if your user is logged on Facebook or not, and if your user has already accepted your application or not. Nov 13, 2010 at 17:02
  • The page shows up until the user accepts accepts my application, regardless from him being logged in or not.
    – abahgat
    Nov 13, 2010 at 17:22

4 Answers 4

10

The issue is caused to the code Facebook uses to bust out of iframes. A bug has been filed on Facebook's bugzilla: http://bugs.developers.facebook.net/show_bug.cgi?id=11326

The only known solution to this problem is to do the first redirect to https://graph.facebook.com/oauth/authorize? from the client side (i.e. Via JavaScript), using

 <script type='text/javascript'>
 top.location.href="https://graph.facebook.com/oauth/authorize?.......
 </script>

This can be triggered when the user clicks on some element (e.g. a login button) or whenever a specific page is visited (just include it in the HTML head).

4
  • How is the redirect handled? I can't redirect to apps.facebook.com/myapp because facebook only allows redirects to my Site URL.
    – shmichael
    Jan 18, 2011 at 9:38
  • It's done via JavaScript (and that's what I don't like of this workaround).
    – abahgat
    Jan 18, 2011 at 19:43
  • I am using Mogli in ROR 3.x, and it doesn't let me do that top.href thing. Can anyone please help me? Aug 24, 2011 at 22:09
  • You should be doing that using JavaScript rather than ROR. I updated the answer so that now it should be a bit more clear about that.
    – abahgat
    Aug 24, 2011 at 22:49
1

yes, top.location.href should do the trick. If you get the problem that the app breaks out the iframe, make sure you use the canvas PAGE url in your redirect, in stead of canvas url (in your app settings)

1

This happens, apparently due to a bug in the Facebook side... I found this solution.

<script type="text/javascript"> 
  top.location.href = '<?php echo $loginUrl ?>';
</script>

$loginUrl = your URL

Could work this way:

<script type="text/javascript"> 
  top.location.href = 'http://www.yourappUrl.com';
</script>

always use this code in script tags...

0

The first page is an error. You absolutely can avoid that page. The problem is likely related to how you are doing the redirects to the login page in the first place. Without a code sample, that is really the best answer I can give.

1
  • Well, that's good to hear, at least. And I updated my question to include the code I'm using. Thanks!
    – abahgat
    Nov 15, 2010 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.