Cross Site Scripting (XSS) between facebook.com and m.facebook.com? - facebook

I'm developing facebook app on platforms: facebook canvas and website (to make it work on mobiles). The problem is that when I'm trying to click on my test app from m.facebook.com website in console i see error:
XMLHttpRequest cannot load
https://www.facebook.com/l.php?u=https%3A%2F%2Fm.facebook.com%2Fapps%2F…
No 'Access-Control-Allow-Origin' header is present on the requested
resource. Origin 'https://m.facebook.com/' is therefore not allowed
access.
And on screen inside facebook body: "No internet connection. Try again." When I click on "Try again" link situation repeats. But when I'm refreshing whole page application opens on web platform as it's supposed to.
Error shows before my app is called so I doubt it's my sdk configuration error.
I'll add that when I'm opening my app from android facebook application or from facebook.com website problem don't occur.
It looks like XSS between facebook.com and m.facebook.com websites. Anyone meet similar issue? Any ideas if I can solve it? I wrote report to facebook and waiting for answer from them as I'm not sure if it's my error or issue lies at their side.
Thx in advance for help.

Related

Facebook browser CORS issue

Trying to figure out an issue that popped up in Sentry today.
I've never seen the 'Facebook' browser come up before, but here it is, all seem to be ios devices:
I don't really understand how there could be an origin issue here as the url listed has the same root domain. Has anyone run into this before?
This means someone is opening your url within the facebook app. Facebook app has its own browser shell to open the link within the app.
You will be able to replicate this issue if you open it from within the facebook app.

Mobile users unable to access Facebook app

My application works with descktop browser but it shows "The page you requested was not found." error by mobile browser. (the screenshot was made by chrome simulator but it shows same by real mobile(android) too)
I already set mobile site url to "Mobile Site URL" field from Setting tab
and turned on "Website - Mobile" checkbox on App Details tab.
I spent all my day trying to find solution without success. Hope someone can help me.
Unfortunately this problem can't be solved :(
https://developers.facebook.com/bugs/1051463851558493/
Hey all,
We recently identified a handful of apps misusing our mobile App
Center to redirect people to unauthorized sites. As a precaution, we
have temporarily turned off the ability for developers to direct to a
destination URL for any app in the "Mobile Site URL" field on the dev
site.
We will be in touch shortly to discuss specific next steps with your
team.
Best,
The Facebook Team

Facebook Login "500 internal server error" in touch mode

We are using the method described in https://developers.facebook.com/docs/facebook-login/login-flow-for-web-no-jssdk/ to log users to our web site.
It was working fine since the last week. Now what happens is that
in mobile devices it does not automatically redirect to our site
after the user logs in.
Instead, the FB server returns a "500 Internal Server Error" error.
But this only happens with the mobile version of the login page
(option display=touch), with the desktop version the redirection
performs well.
This works:
https://www.facebook.com/dialog/oauth?client_id={myAppId}&redirect_uri={myurl}
This doesn't work:
https://www.facebook.com/dialog/oauth?client_id={myAppId}&redirect_uri={myurl}&display=touch
As we didn't know if the service was down for whatever reason
or there was a problem with our FB application,
we have created another FB application and we have set the web site
to a known url: www.google.com.
Then we have tested the url:
https://www.facebook.com/dialog/oauth?client_id={myOtherAppId}&redirect_uri=wwww.google.com&display=touch,
and to our surprise it worked, resulting in a redirection to the
google search site.
But if we set our web site in both the test FB application and the login url, it fails again with the same "500 Internal server error".
So we suspect that there is something wrong with FB and our domain.
Could FB be blocking my URL when trying to redirect through the mobile version of the login dialog?
We would like to contact the FB support team directly by email but we are unable to find a way to contact them.
Can anybody give us a clue on this?
Sometimes it's because your app is in Sandbox mode.

How can I make Facebook App page visible on mobile?

On my client's Fanpage, a third party app is running for a contest. How can I make this FB contest page available on mobile? I read the answer here:
http://facebook.stackoverflow.com/a/10833366/461119
also
Facebook SDK : Page Tab App returns not found in mobile Facebook App
I do not understand it clearly.
Is the query parameter ?ref-ts which we have to add at the end of URL?
What does it mean by "It helps in the browser but not the app itself."?
Will it help to see the App on mobile and click on it to go to the contest page on FB?
Also, I found this answer:
Works as advertised! Thank you. I was getting 404, but simply adding
ref=ts in my redirect URLs (I force users to use my app as a page tab)
fixed it! – Guillaume Boudreau
under the first link above but what is forcing users to use app as a page tab?
How can I set App as a page tab?
little bit confused.
I searched the web vigorously but did not get any clear explanation.
My observations about this issue:
Seems like it's an ANDROID issue, Work OK on iPhone's
Work with the link redirection services like Bit.ly (where the bit.ly link included the ref=ts)
I sent an email to Facebook for ANDROID developers.
Hi,
my iPhone's user colleagues can open links to page tab app with ref=ts
parameters but on Android we can't ;-(
The only way we've been able to do it is when the link to the app is
under a bit.ly redirection link
The problem is only when the links are open through the Facebook App.
Thanks
Let us know
Max*
You can access to your app using the next link https://apps.facebook.com/YOUR-APP-ID
In this way, you can access from a desktop or a mobile with no problem.

Facebook Application Error: https://www.facebook.com/4oh4.php

I am new in developing my facebook application. I know php, HTML. I have a application in my server: http://www.example.com/app_name
with only one file written in php i,e index.php
I filled all the requisite as instructed by facebook documentation for canvas URL and all. Now when i am trying to access this http://apps.facebook.com/app_name
I get this error: The Page you requested was not found.
https://www.facebook.com/4oh4.php
Can anyone please help me????
There is a currently open bug report in Facebook's bug tracker about this issue: https://developers.facebook.com/bugs/325223977546904
It could take a while for your app to propagate to all FB servers so you may just have to wait a little. Are you logged in as the administrator to the app? If you have it set to private then you will be redirected to the 404 page if you are not an admin or tester.
I had the same issue which seemed to be transitory. About ten minutes later the site started working again. Facebook.... Sigh.