Facebook signed_request cookie persist wrong code - facebook

Question

I'm trying to get user pages:
<?php
try {
$pages = $facebook->api('/me/accounts?fields=id,name');
if (isset($pages['data'])) {
$this->assign('pages', $pages['data']);
$this->pages = $pages['data'];
}
} catch (\FacebookApiException $e) {
$loginUrl = $facebook->getLoginUrl(
array(
'redirect_uri' => $this->container->getParameter('home_url'),
'scope' => 'email,manage_pages'
)
);
echo '<script type="text/javascript">top.location.href = "'.$loginUrl.'";</script>';
exit;
}
but I jump into endless redirect loop. After some research I found out that PHP SDK get's an error from API in getAccessTokenFromCode method. $access_token_response variable is:
{"error":{"message":"This authorization code has expired.","type":"OAuthException","code":100}}
PHP SDK takes code value from COOKIE. The problem is that fbsr_{app_id} is not flushed and it still contains the same code. And that's the reason for endless loop.
What can I do to overcome this problem. I was thinking about deleting fbsr_{app_id} cookie but it looks weird. Why does SDK not handle this for me?

Answer 1

If you are using PHP 5.4, I ran into this issue too. I wrote up a tutorial on how to fix the issue. The reason was the PHP SDK wasn't picking up the code correctly.
You could also try to destroy the session (session_destroy() or the Framework equivalent) or manually clear the cookies (setcookie ("cookie_name", "", time() - 3600);) if a exception is received.
EDIT:
Make sure the App ID and App Secret in the app are correct too. An incorrect app secret is sometimes the issue as it's used to decode the signed_request.
Also, if the problem is specific to IE, try adding the following header to your code:
header('P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT');
IE's security settings sometimes prevent cookies from setting in iframes. The above header should help.

Answer 2

OK, I think I found workaround. I'm using both PHP SDK and JS SDK. I used following code for redirection:
echo '<script type="text/javascript">top.location.href = "'.$loginUrl.'";</script>';
exit;
But I added JS SDK to it and problem does not occur anymore:
echo "
<div id=\"fb-root\"></div>
<script type=\"text/javascript\">
window.fbAsyncInit = function() {
FB.init({appId: ".$app_id.", status: true, cookie: true, xfbml: true, oauth: true});
FB.getLoginStatus(function(response) {
top.location.href = '".$loginUrl."';
});
};
(function() {
var e = document.createElement('script'); e.async = true;
e.src = document.location.protocol +
'//connect.facebook.net/en_US/all.js';
document.getElementById('fb-root').appendChild(e);
}());
</script>
";
exit;
I'm not sure if it's not a bug of JS SDK/PHP SDK.