I have a web app that uses firebase for auth. Once a user signs up/logs in there is always a certain cookie present.
I would like to, based on the presence of that cookie, redirect the user from the root path to a sub path i.e. site.com=>site.com/app whenever they visit the site.
I'm using Netlify to host my site and I've read through their documentation
but I can't figure out anyway to do this. It appears as though the only "conditions" that can be used for a redirect are langauge & role, but nothing about cookies.
Maybe this is possible using JWT Roles?
It's not possible today, but you can keep an eye on this thread: https://community.netlify.com/t/expanding-functionality-of-redirects/988/36?u=goleary
I am trying to create a website that can run on a few different subdomains that has FaceBook integration. I would ideally like domain1.mysite.com and domain2.mysite.com etc etc to work with 1 Facebook app, and not have to set each one individually in the app's 'Valid OAuth redirect URIs'.
This: How to add multiple facebook callback urls is the only thing I have found on the topic. While it does work, I am unsure if that is properly secure or if it just happens to work and will get fixed up at a later date. Anyone have some insight on this?
The app I'm building is going to have multiple parts over various subdomains, i.e. front-end "domain.ca", and api would be "api.domain.ca". In the facebook app settings we set the domain as "domain.ca", and the website url as "http://domain.ca", it says it would allow all subdomains access as well.
When I try to use the auth on "api.domain.ca", I get "Given URL is not allowed by the Application configuration: One or more of the given URLs is not allowed by the App's settings. It must match the Website URL or Canvas URL, or the domain must be a subdomain of one of the App's domains."
How can I make this work? We want the user to be able to use the login on the front side, and pass the access_token to the api side to check if the user exists, or create a new user and attach the social login.
Any help would be greatly appreciated.
Thank you to Periklis Koutsogiannis who posted an answer to my question on the Facebook Developer Community page: "You may fill the Valid OAuth redirect URIs under Client OAuth Settings in Settings/Advanced." This solved the issue.
Our website runs in public computers and the browser is restricted to our own site. Facebook needs a redirection for security reasons. Can this be avoided somehow?
If not, which are the urls I'd have to allow/unlock?
Have a look at
https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/v2.2#login
You need to use the following structure:
https://www.facebook.com/dialog/oauth?client_id={app-id}&response_type=token&redirect_uri=https://www.facebook.com/connect/login_success.html
Have a look at the hints in the blue box at the bottom of the docs paragraph:
When using a desktop app and logging in, Facebook redirects people to the redirect_uri mentioned above and places an access token along with some other metadata (such as token expiry time) in the URI fragment:
https://www.facebook.com/connect/login_success.html#access_token=ACCESS_TOKEN...
Your app needs to detect this redirect and then read the access token out of the URI using the mechanisms provided by the OS and development framework you are using. You can then skip straight to the Inspecting access tokens step.
I know that facebook allow me to specify multiple domains for my app.
But in the "Website with Facebook Login" i can only specify one url.
Is it possible for me, to authenticate users on domain.se, domain.dk and domain.net with the same App ? Or should i still create one app, for each domain ?
It is technically possible to use Facebook Connect on multiple domains, there are some limits (5 domains max).
So the key to doing this is adding all domains in the App Domain field under your app settings.
The PROBLEM, however, is that Facebook only lets you add domains that are derived from your Canvas URL or Site or Page tag URLs, so if you try to enter anything else you get an error that looks like this:
The SOLUTION is to create App on Facebook, Website, and Facebook Tab using the ADD PLATFORM button and then put in URLs that point to your other domains. Here is an example of what I mean:
If you use a unique domain for each field you can max out with 5 different domains. I have tested this technique with up to 3 domains, but i think it should work for all 5.
Note: Facebook admin features change from time to time, so all of this is subject to change
As long as you listed all the desired App Domains in application settings you should be able to authenticate users on any of them.
"Website with Facebook Login" is really only intended to be used as link to your site/application.
Update 2 (July 2016):
App domains must match the domain of the Secure Canvas URL, Mobile Site URL, Unity Binary URL, Site URL or Secure Page Tab URL.
Update (December 2013):
At the time of writing original answer it was possible to list any domains in application settings but from that time the UI of Application Settings (as well as way of handling Application Domains) changed at least couple of times, at some point you could only list domains that derive from one of application's canvas pages.
As of December 2013 it is possible (again) to list domains that do not derive from application canvas URL.
Assuming your domains are being served by the same web server and you have access to that web server, you can use the manual login procedure: https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow to login from as many domains as you wish.
Assume your domains are site1.com,site2.com.... Instead of using the Facebook javascript API, you will simply place a plain old Log In with Facebook button on each site which will redirect the browser to the facebook login page as described in the above article. In the state variable you can specify a code which indicates which of your sites is requesting a login. In the redirect you will use a single service domain which you assign to your web server (e.g. fb.mywebserver.com) and which you specify as the verified redirect url in the facebook login settings page. All the sites will redirect to this same url, avoiding the problem of supporting multiple domains.
Once the user has logged in, the browser will redirect to fb.mywebserver.com and pass it the state, which tells you which site is requesting login and a code which you can use on the back end to retrieve the user's info using the Facebook graph apis. You store this info with a uid in your data store then using the info in state, you redirect to to the appropriate site including a parameter that indicates a Facebook login (e.g. site1.com?fbc={some uid}). The browser will obediently then call site1.com?fbc... Your web server will receive this request and detect the fbc parameter which tells it to associate the corresponding Facebook logged in user with this site. It can then retrieve the logged in users info using the uid and, for example, return a session cookie for this user along with the page. If you generate the page on the server you can, of course, also include a welcome "user" or alternatively, your client code can do an ajax call to retrieve that information.
From the user's standpoint they press the Login with Facebook button, are redirected to a Facebook login page where they login and then are redirected back to your site in a logged in state. Not quite as nice as having the login popup but likely acceptable.
A similar process can be used for google logins as well
Best thing I've found to do in the development/production scenario is add a "Test App", then add a platform for your development web site - as you have to provide where the "page tab url" lives if you use that as a platform.
Facebook requires your "page url" to be live / accessible if you need to apply for status or permission review.
This got me around the "login in development" / "login in production" scenario.