VK API, access denied for post on wall of a community, fail WALL Permissions - access-denied

I build API for post on my community of VK. But I check my permission for my app, and I have all permissions, but not load WALL permissions.
In the scope for OAuth, I put all scopes and not work the WALL. I check the "Api.console" and they have "Access to Wall - The application has access to your wall", but in my app not appear.
This is the response:
{"error":{"error_code":15,"error_msg":"Access denied: no access to call this method","request_params":[{"key":"oauth","value":"1"},{"key":"method","value":"wall.post"},{"key":"owner_id","value":"-*********"},{"key":"from_group","value":"1"},{"key":"message","value":"New post on group wall via API."}]}}
I check other services and if work.

You can't call wall.post (and a lot of other methods) with a non-standalone applications. It seems like your VK application is of type Website or iFrame - they have limited access to the API methods.
However, while you can't call this method from non-standalone applications, can via the Open API (it's a JavaScript SDK for Website applications) or the JavaScript SDK for iFrame applications.
When you call wall.post via these SDKs, a confirmation window will appear where the user needs to confirm the wall post before sending it:
Standalone applications are designed to be used in apps like mobile or desktop clients or browser extensions (because they don't have CORS limitations and may read any tab). There is absolutely no ways to get a user's standalone access token without limitations if you are trying to authorize them via website.
If you are building website or something and need wall.post for service purposes (e.g. news cross-posting), then you may get your token and save it anywhere in site configuration. Open this address:
https://oauth.vk.com/authorize?client_id={APP_ID}&scope={PERMISSIONS}&v={ACTUAL_API_VERSION}&response_type=token&redirect_uri=https://oauth.vk.com/blank.html
{APP_ID} - your standalone application ID (may be found in application Settings).
{PERMISSIONS} - comma-separated list of permissions. Don't forget the offline permission to get token that doesn't expire.
{ACTUAL_API_VERSION} - VK API version.
Example:
https://oauth.vk.com/authorize?client_id=123456&scope=wall,offline&v=5.60&response_type=token&redirect_uri=https://oauth.vk.com/blank.html
Note that redirect_uri=https://oauth.vk.com/blank.html is required to get token without the above mentioned limitations.
After you grand your application access to your account, access token without limitations will appear in your browser address bar. Just copy it, save in your configs and feel free to call any methods you want.

Late but...for this you need to first create a sort of "demo" app for VK using the standalone app type which would issue you an access token inside the address bar when you set the redirect link to https://oauth.vk.com/blank.html
This access token would allow you to share to your personal profile wall.
Then you need to contact VK support and display your app in action. Once they approve it then you'd be able to use a "Website" app that has OAuth style authentication

Related

Facebook Graph API - Publicly access Pages info

I have a JavaScript script that fetches data of a Facebook Page URL and puts it in a form. It works perfectly as long as I am connected to my Facebook Developer Account, and that I use the corresponding App ID.
My question is: can I make this public? Without need to be connected to my Facebook account? I want users on my website to be able to use this feature but I can't figure this out, and I'm now wondering if it's even possible.
This concerns Pages specifically (not Events).
You either have to make users login to your app (so that you can use their access token to request the data),
or you need to move it to the server side, so that you can use either an app or a page access token (both of those should never be exposed in client-side code.)

Is it possible to send a request to the Facebook Graph API from client side without exposing our access token to the public?

My question is related to, but not exactly, this question.
I am currently working on a business directory Web site (similar to Yelp), in which businesses have their own pages. Let's call this app DIRECTORY_APP.
Businesses might want to have their latest Facebook status update shown on their pages hosted on our directory. Let's pretend we have a business named BIZ_1. The assumption is that those pages are public pages.
Apparently the Facebook Graph API can be used for this purpose. So I can send a request to Facebook to retrieve the latest status updates for BIZ_1:
https://graph.facebook.com/BIZ_1_PROFILE_ID/posts?
access_token=DIRECTORY_APP_ACCESS_TOKEN
&callback=callbackName
However, if I use this from the client side, our Web site's access token will be exposed to the public, so this is not a reasonable solution.
Now in the aforementioned question, Anatoly mentions that we can retrieve the access token by sending this request first:
https://graph.facebook.com/oauth/access_token?
client_id=YOUR_APP_ID&client_secret=YOUR_APP_SECRET
&grant_type=client_credentials
However if someone inspects the Network log, this will also expose our Web site's access token (is this correct or is this a different type of access token?). This solution also exposes our web site's app secret (is this safe?).
So to summarize, what's a safe way in which I can retrieve the latest status update of a Web page from client-side without asking the browsing user to first log in to Facebook?
I can retrieve the latest status update of a Web page from client-side without asking the browsing user to first log in to Facebook
You cant do that without login.
And I guess access token is not exposed.
Maybe the smart trick here is to use a social plugin. The Like Box will do what you want, without any issues. But, it's not greatly customizable. Even so, it's possible to get it looking nice on a page!
It also skips any login issues you mentioned.
I found the answer after some Googling. In short, the answer is no.
And here's an excerpt from Facebook:
Security Best Practices
App Secret and App Access Token
The App Secret is used in some of the Login flows to generate access tokens and the Secret itself is intended to secure usage of your App to only those that are trusted. The secret can be used to easily create an App Access Token which can make API requests on behalf of any user of the app, which makes it extremely important that an App Secret is not compromised.
Therefore the App Secret or an App Access token should never be included in any code that could be accessed by anyone other than a developer of the app. This applies to all methods of code that are not secured like client-side code (such as HTML or Javascript) or native apps (such as iOS, Android or Windows desktop apps) that could be decompiled.
We recommend that App Access Tokens should only be used directly from your app's servers in order to provide the best security. For native apps, we suggest that the app communicates with your own server and the server then makes the API requests to Facebook using the App Access Token. For this reason, if your 'App Type' under Advanced Settings in the App Dashboard is set to Native/Desktop we assume that your native app contains the App Secret or an App Access Token in the binary, and we do not allow calls signed with an App Access Token to proceed. The API will behave as though no access token was provided.
If your App Secret is compromised, you should reset it immediately in the Basic Settings of your App Dashboard.

Interaction with Facebook API without full OAuth, is it possible?

I need to post message on a certain FB page as a owner by cron, using php and ZF 1.1.X. For this small issue, I don't want to create a full OAuth stack. Is it possible to communicate with FB API (it's desirable, PHP SDK for FB) without it, such as twitter with his precreated access tokens (Access token, Access token secret)?
As long as you need an active user access_token to retrieve desired data this is not possible to skip OAuth flow.
Without authenticating user you only have application access_token (in old format APP_ID|APP_SECRET, but it's still works) and only limited access to most of Graph API endpoints and Application settings.
Actually there is nothing hard in implementing the user authentication with OAuth flow and it is completely transparent with usage of PHP-SDK.
Just look at the sample code in documentation for server-side authentication
Yes, you need to build an app and then authorize the page via the app while requesting the manage_page permission.
You should make yourself familiar with the Server Side Auth process as well.

Facebook authentication from restricted zone

Consider the following situation: internet provider has a selfcare site that is integrated with facebook, i.e. user can login toselfcare site using his facebook credentials.
However, when user has not paid for the internet access, he is limited to the provider's only sites (ex. selfcare.provider.com). In this case, facebook integration stops working due to access restrictions.
Question is: is there a way of restricting access to facebook in such a way, so that only login can be enabled?
You want to allow users to authenticate against your app without allowing them to access Facebook itself?
I don't think that will be possible short of applying some custom logic on your end to try to determine if a request to Facebook is for login purposes or to access Facebook itself - there's no API for this.

How to limit information requested by my facebook app

I'm using facebook connect to allow the visitors login to a website using their facebook account.
The only information needed is that the user id and name.
However the facebook connect dialog states that my app will access all the users friends, photos...
How can I configure my facebook application to not request those data?
The quick answer, you can't. The dialog states that you have the ability to access the user's information. Whether you access it or not is up to you, but the ability to is always there. There is a base level of access granted to all apps. You can prompt for extended permissions, but you can't customize the base level.
This may change going forward with OpenGraph. There are still features Facebook is adding, and some existing, undocumented features.