Php-graph-sdk: Bug when using a valid access token by invalid appsecret_proof that is disabled

[mvcmaker]

Hi,
I'm using the latest version of the sdk (5.5.0)
I've unset the appsecret_proof in the app advanced config, but when I use a valid access token got directly from the api tools. But I get all the time the next error:

Invalid appsecret_proof provided in the API argument

This is a code issue, due I'm using the main README.md code that should works but don't. Please, check it and fix it this, so we can not use que facebook until now.

[yguedidi]

@mvcmaker do you get an access token from the API tools for the right app?

[mvcmaker]

Of course, in fact, this access token works fine when I use the graph tools with my app account.

[SammyK]

This happens when your app secret doesn't match the app that the access token belongs to. So make sure to double check that. If it's still not working, can you post some code?

[mvcmaker]

Of course, here you have:

This code is in my constructor:

        $this->fb = new \Facebook\Facebook([
            'app_id'=>FB::APP_ID,
            'app_secret'=>FB::APP_SECRET,
            'default_graph_version'=>FB::DEFAULT_GRAPH_VERSION,
            //'default_access_token'=>FB::SAMPLE_ACCESS_TOKEN, //Optional,

            //'appsecret_proof'=>$appsecret_proof
        ]);

And the next code is on the method that I want to check the user existence:

try {
          // Get the \Facebook\GraphNodes\GraphUser object for the current user.
          // If you provided a 'default_access_token', the '{access-token}' is optional.
          $response = $this->fb->get('/me'/*?fields=id,name,email'*/, $fbToken);
          //$response = $this->fb->get('/me?fields=id,name,email&appsecret_proof=' . $appsecret_proof, $fbToken);
        } catch(\Facebook\Exceptions\FacebookResponseException $e) {
          // When Graph returns an error
          $this->lastError = 'Graph returned an error (accessToken ' . $fbToken . '): ' . $e->getMessage();
          return false;
        } catch(\Facebook\Exceptions\FacebookSDKException $e) {
          // When validation fails or other local issues
          $this->lastError = 'Facebook SDK returned an error: ' . $e->getMessage();
          return false;
        }

        $me = $response->getGraphUser();
        echo 'Logged in as ' . $me->getName();
        return true;

[yguedidi]

@mvcmaker what https://developers.facebook.com/tools/debug/accesstoken/ says?

[mvcmaker]

Tells that's all it's ok

[mvcmaker]

php-graph-sdk automatically sends appsecret_proof key when sending both, post or get requests, and this can not be modified directly without modifyin the main framework, but out configuration has appsecret disabled, this is the reason of working using the debug tools and not the the github sdk code. Still more, the code that gives you facebook to use the php-graph-sdk doesn't works, is deprectaed of a sure old api.

[yguedidi]

@mvcmaker and the credentials configured for the SDK are exactly the same than the credentials of the application linked to the access token in Access Token Debug Tool?
By exactly I mean beware of any hidden character at the begining or the end of the app id and app secret.

I don't think this is an issue in the SDK, overwise the SDK will be unusable, and not only you will complain about this :)
I'd suggest you to ask on StackOverflow for your issue, as the GitHub issue tracker is for SDK issues or feature suggestion.

[mvcmaker]

Yes, are the same. It's an issue of the SDK, due when I call directly using curl by get, and ommitign the get request var appsecret_proof, the response is the expected, but when I use the $fb->get() method, the result is always the unexpected error that is the main reason of this post.

[mvcmaker]

stackoverflow has just passed away through my post, no response, no answers. Has been 100% omitted by everybody.

[yguedidi]

please var_dump($appSecret) and var_dump($this->value) just before the return here: https://github.com/facebook/php-graph-sdk/blob/5.5/src/Facebook/Authentication/AccessToken.php#L70
Is the access token the one you provide? is the secret the one you provide?

[mvcmaker]

Yes of course, the same

[mvcmaker]

Can you give me please, a contact mail of a facebook technitian? This is a problema that must solve facebook, no github, it's a facebook problem, for two reasons: The first is that the sdk they provide doesn't work, the second is that the code they give to use it doesn't work neither, due is calls a method that doesn't exists.

[yguedidi]

the appsecret_proof behavior is unit tested, it should work, so if you manage to provide use a failing test, it would be easier to solve your issue. Please open a PR with the failing test.

[mvcmaker]

What is a PR? I'm new in github.

[yguedidi]

this SDK is maintain by 2 Facebook SDK lovers, @SammyK and myself, and we don't work at Facebook.
A PR is a Pull Request, a contribution you do to a project, read this: https://help.github.com/articles/about-pull-requests/
You should read the whole GitHub help, it's pretty complete :)

About your bug, if you think it's a bug from the Facebook side, open a bug report here: https://help.github.com/articles/about-pull-requests/

So I'm closing this. And check this StackOverflow: https://stackoverflow.com/questions/18683421/why-do-i-get-invalid-appsecret-proof-provided-in-the-api-argument

[mvcmaker]

This issue has not been solved yet, please, consider to keep opened before close it. Can you reopen until will be solved? Thanks!

[mvcmaker]

I've opene a new pull request to solve this issue. Facebook has confirmated me that is a bug from the sdk, as I was thinking. Please, consider this pull request because now I'm working directly using curl requests and is not the best idea. Thanks,

[yguedidi]

Please link to the bug in the Facebook issue tracker where Facebook answers you. Thanks

[SammyK]

It's easy to copy & paste the app secret incorrectly from the app settings in the dashboard. I do it all the time incorrectly, so make sure your app secret didn't get accidentally truncated when you copied it into your app.

Also - put this bit of code above your try statement that tries to grab the user:

$params = http_build_query([
    'fields' => 'id,name',
    'access_token' => $fbToken,
    'appsecret_proof' => hash_hmac('sha256', $fbToken, FB::APP_SECRET),
]);
$response = file_get_contents('https://graph.facebook.com/v2.9/me?'.$params);
var_dump($response);
exit;

What response do you get?

[mvcmaker]

Good morning from Spain, a new working day begins, so let's go. This is the code that Facebook gives when you use the Api graph explorer, and obviously this code is incompatible with the php-graph-sdk, due the parameters are wrong passed to the FacebookRequest constructor:

$request = new FacebookRequest(
  $session,
  'GET',
  '/me',
  array(
    'fields' => 'id,name,email'
  )
);

$response = $request->execute();
$graphObject = $response->getGraphObject();
/* handle the result */`

[mvcmaker]

Regarding to you issue comment #issuecomment-311189131, I've checked what you told me and both, app_secret and access_token are the same.

[mvcmaker]

This is my new code for the cusotmized getUserData method:
`public function getUserData($fbToken=null) {
if(is_null($fbToken))
$fbToken = $this->accessToken;
if(!$this->usePhpGraphSdk) {

        $data = [
            'access_token' => $fbToken,
            'fields' => 'id,name,email',
        ];
        //print_r($data);
        $resp = curlGet("https://graph.facebook.com/v2.9/me", $data);
        $resp = json_decode($resp, true);
        if(isset($resp['id'])) {
            return $resp;
        }
        if(isset($resp['error'])) {
            $this->lastError = $resp['error']['message'];
            return false;

        }

    }


    $appsecret_proof= hash_hmac('sha256', $fbToken, FB::APP_SECRET);
    $request = $this->fb->request('GET', '/me');
    $params = http_build_query([
        'fields' => 'id,name',
        'access_token' => $fbToken,
        'appsecret_proof' => hash_hmac('sha256', $fbToken, FB::APP_SECRET),
    ]);
    $response = file_get_contents('https://graph.facebook.com/v2.9/me?'.$params);
    var_dump($response);
    exit;
    try {
      // Get the \Facebook\GraphNodes\GraphUser object for the current user.
      // If you provided a 'default_access_token', the '{access-token}' is optional.
      //$response = $this->fb->get('/me'/*?fields=id,name,email'*/, $fbToken);
        $response = $this->fb->getClient()->sendRequest($request);

      //$response = $this->fb->get('/me?fields=id,name,email&appsecret_proof=' . $appsecret_proof, $fbToken);
    } catch(\Facebook\Exceptions\FacebookResponseException $e) {
      // When Graph returns an error
      $this->lastError = 'Graph returned an error (accessToken ' . $fbToken . '): ' . $e->getMessage();
      return false;
    } catch(\Facebook\Exceptions\FacebookSDKException $e) {
      // When validation fails or other local issues
      $this->lastError = 'Facebook SDK returned an error: ' . $e->getMessage();
      return false;
    }

    $me = $response->getGraphUser();
    echo 'Logged in as ' . $me->getName();
    return true;
}`

[mvcmaker]

Hi @SammyK, regarding your issue comment, I've tried to apply it your code, it returns an error:

Warning: file_get_contents(https://graph.facebook.com/v2.9/me?fields=id%2Cname&access_token=EAACEdEose0cBAPKOeiRWXY2xqziAITEAZBZBBz4z9CZBpg6on6KhPQiduxc6I9XRZCZC8XZAcWbb38yDgwCCzePe4K7akFc2oPZBhKt85xXuc8Ji8vvwwaKBZAHmFXTZCFBpSOtttmZAsNoUlBzxtZAIanQIo644tVdaryrcxFhq42QKotYZAtDok4VMLJe9zX5pGouD2LECT36RfXDRv7u0huyb&appsecret_proof=5ee629062f2155561b3dd8c7e44008895e5ec5ed225d5915d9da138397f97c6a): failed to open stream: HTTP request failed! HTTP/1.1 400 Bad Request
in /var/www/appservices/webservices/facebook/facebook_custom.php on line 133

bool(false)

But I can apply more friendly than your code, using my direct curl call as follows:

`if(!$this->usePhpGraphSdk) {

        $data = [
            'access_token' => $fbToken,
            'fields' => 'id,name,email',
            'appsecret_proof' => hash_hmac('sha256', $fbToken, FB::APP_SECRET),
        ];
        //print_r($data);
        $resp = curlGet("https://graph.facebook.com/v2.9/me", $data);
        $resp = json_decode($resp, true);
        if(isset($resp['id'])) {
            return $resp;
        }
        if(isset($resp['error'])) {
            $this->lastError = $resp['error']['message'];
            return false;

        }

    }`

In this case, when I call it, I get the next:

Can't

get user information due Invalid appsecret_proof provided in the API argument

But when I call removing the appsecret_proof key in my code, the response is ok (my log data extraction):

[2017-06-27 08:49:11 am] FB_DATA FB_001_TEST RESPONSE:
[id] => \224363201415518\
[name] => \Juan Juan\
[email] => \[email protected]\

Why is the appsecret_proof is always invalid? That is the question.

[mvcmaker]

Hi all, the issue has been solved. The problem was with the access token, that was generated as generic manner using the facebook api graph explorer, instead to be generated for the target application associated with the app_secret and app_id keys. The generic token seems works independently the app_secret and app_id passed, and fails when is passing the optional appsecret_proof request var.

Thanks for all your feedback, but there're are a lot of problems with the facebook tools that doesn't work fine with the php-graph-sdk due uses code that is deprectaed for current sdk version 5.5 as I told you in the post #issuecomment-311280542.

[yguedidi]

and the credentials configured for the SDK are exactly the same than the credentials of the application linked to the access token in Access Token Debug Tool?

:)

[mvcmaker]

@yguedidi. Regarding to your comment id #issuecomment-311197132, here you have the facebook bug link:
https://developers.facebook.com/bugs/932163706922443

Regarding to the last post, I don't know what is the credentials you mean in this Access Token Debug Tool, I use the API graph explorer tool, but this not uses any credential except a single access token.

[mvcmaker]

I have a question now. There's any way to validate access token before call a request method? I mean that the FacebookAuthenticationAccessToken class has several methods, but no one told me if this token is valid by associating token with either app_id or app_secret.