Php-graph-sdk: Facebook Strict Mode and state parameter

[sempiterna]

In march, facebook will require Strict Mode, and since the "Valid OAuth redirect URIs" field does not allow for dynamically generated data, dynamic data should be passed with a state paramer (according the facebook docs). As it stands now, facebook login in my application will fail completely in march due to these restrictions:

"Can't Load URL: The domain of this URL isn't included in the app's domains. To be able to load this URL, add all domains and subdomains of your app to the App Domains field in your app settings."

The domain is added to App Domains, and the error disappears when a "Valid OAuth redirect URIs" is set .

The strange thing is that the documentation (https://developers.facebook.com/docs/facebook-login/security#strict_mode) states the following:

"For apps using only the Facebook SDK, redirect traffic is already protected. No further action is needed."

This is clearly incorrect, since with strict mode enabled, facebook login fails, and it only seems to work if I add an exact matching "Valid OAuth redirect URIs". Which is impossible to do with dynamic data.

How does one fix this by using the state parameter in the Facebook PHP sdk? State parameter usage is undocumented in this sdk.

[NickStallman]

I do it like this:

$helper = $fb->getRedirectLoginHelper(); $pdata = $helper->getPersistentDataHandler(); $pdata->set('state', $what_you_want_as_state);

However there is a further bug which I will do a pull request for.

[sempiterna]

Thank you for this, NickStallman. I got it somewhat working now. Though it now makes my own application potentially less safe. These breaking changes soon to be enforced by Facebook basically disallow the use of wildcard subdomains (which I use since very user has its own subdomain in my app, and thus also a php session confined to the subdomain).

Now, for Facebook login, I have to redirect the user to the main domain while having the session ID in a GET variable (which I usually avoid at all cost). I then have to overwrite the php session of the main domain with the one from the subdomain, and then redirect back when login is completed. Which causes issues if, somehow (in an extreme possibility), the user is simultaneously using both the main and subdomain for actions.

A custom state is also less safe, because it can be very simple and contain the same value for every user if a scripter is a bit lazy.

Anyway, the situation i described above is not really relating to the php sdk, but frustrating nonetheless.

[yguedidi]

@sempiterna just released the 5.6.2 version that fixes this issue! see #913, feel free to reopen this if your issue is not solved

[DrLightman]

I'm facing the same problem @sempiterna had. I need to transmit some dynamic data togheter with the redirect uri and I would defintely love to do it in the URI itself (/foo/bar/) or via a get parameter (...&foo=bar&...). I'm still not getting the security thing in all this strict redirection URIs since I'm the one generating them, and I would be perfectly fine to just allow permission to my whole domain.

That said, I've a feeling that using the persistent data as suggested (aka, the $_SESSION...) wouldn't be ideal in my case because I'm generating redirection uri's in many pages of my website in order to achive an user action and I suspect it would clutter the session storage with a lot of data and only a small portion of it would be used in the end.

Instead having the data stored in the URI would only take space in the HTML's bytes.

In my website I've simple redirect URI let's say to register or login and in that case I can use root URIs:

example.com/

But for more complex actions let's say sign a petition or put an instant like to a post, I'd need something more dynamic:

example.com/?post2like=123
or
example.com/some-post/

I'm really having an hard time in order to figure out how to handle those cases with php graph sdk

Any suggestion would be really appreciated.