We have a browser based game which uses Facebook Connect through an AppID that we used to run the same game in a canvas until Fb Credits were introduced and we were forced to shut it down. Now, we only use the App the same way as a product page with the FbConnect integration on our own site.
Today's mail states for our case:
If your Connect app is accessing user connections or asking for additional permissions beyond age, email, and our Publishing Permissions, please remove these requests.
(This refers to this policy change: https://developers.facebook.com/blog/post/2012/09/05/platform-updates--operation-developer-love/)
We are using oauth FbConnect with scope=email,user_birthday. This is exactly what was specified in an earlier mail so it should be ok.
Once the user is authenticated, we simply call
https://graph.facebook.com/me?access_token=...
and read what comes there.
Is it possible, that we are not allowed to call the GraphAPI's me anymore? It contains info like gender, location and locale...
The Oauth data contains the fbuid, first/lastname and the email, but it does not contain the age, what we are supposed to be allowed to ask?
Do I have to call https://graph.facebook.com/me?fields=birthday explicitly?
Did anyone actually succeed in getting an "desktop web game hosted primarily off Facebook" to comply with their new policy without creating a new AppID?
Note: There have been a couple of questions about the "Sep 5th policy change" like Facebook: Notice of Violation this one and many previous closed as duplicates, but none I found so far contains questions or answers on a technical level.
Maybe you could skip the "Website with Facebook Login" part in developer settings and only provide your game directly via canvas. (eg. apps.facebook.com/logogame). that's what "on facebook.com" is all about, I guess.
Related
We have been trying to get facebook approval for the use of an existing, already approved (with other people using it) third party extension for magento 2 that helps a user design photo albums. We would like to enable our customers to have access to their facebook photos when designing photo albums.
The initial app review was submitted at about the time facebook started making all of it's changes and thus sat idle for three months as they changed some of their internal policies and handled the subsequent backlog. It was even cancelled at one point requiring us to re-submit it.
Most recently, it finally received a review and was rejected because facebook confused the photo behavior with the login behavior.
I'm not trying to re-submit the review request with more details to show that it's a different piece of software performing a different function from the login-with-facebook but now (unlike the first time) I'm getting an error when using one of the test accounts:
Can't Load URL: The domain of this URL isn't included in the app's domains. To
be able to load this URL, add all domains and subdomains of your app to the App
Domains field in your app settings.
This error didn't appear when I created the 'experience' video 3 1/2 months ago so presumably it's something new from facebook's end as the settings in the app haven't changed. I can only guess as to the cause, but the third party app uses an end-point that is not on our domain but is instead one of their domains for their designer hub which actually handles the album design. The plugin is the MediaClip album designer and the end point is on photos.mediacliphub.com
But the facebook app settings won't allow me to add photos.mediacliphub.com to the App Domains saying:
App domains must match the domain of the Facebook
Web Games URL (https), Mobile Site URL, Unity Binary
URL, Site URL or Secure Page Tab URL. Please correct
these domains: photos.mediacliphub.com
Of course since we are the only one of their customers sitting in the middle of a review process at the moment, I'm having a hard time convincing mediaclip that it is a problem with the urls/changes-at-facebook. (especially since I am not entirely sure of that myself)
Facebook, meanwhile has closed itself off from the world in regard to any means to contact support with an actual specific question or inquiry. I've tried joining the Facebook Developers group on facebook and posing the question but so far it hasn't received a single reply or comment.
If anyone knows what might be going on or has any suggestions, it would be greatly appreciated for as of this point, I can't even re-submit the review request if I'm receiving errors in the experience as it will just get rejected.
So we've developed a Facebook App (and similar apps on Twitter and Instagram) that allow users to post and read content using an external system. We'll sell this integration directly to our clients, so it's a private application.
Basically the user will see a very simple page with a button "Log in to Facebook" and a disclaimer regarding the authorization (we'll use some query params fixed in the url, depending on the client). The client authorize us and we capture the access tokens.
To submit the app review, though, we have to explicitly give a test user to the reviewers, but that's not really possible because the real "action" happens within the integrated systems, NOT within the app itself. And those systems are not public (they shouldn't be).
So just to be clear: our app is basically a very simple "Facebook login" that we use to get tokens, generated by specific clients authorization. It's not going to be published anywhere.
Until we have around 5 to 10 clients we can add the specific users in our app as Testers/Admins/etc, but what if we scale up? Say we have 20 clients. How are we supposed to get our app to be "live"?
To follow the app review steps we would have to create some users in our local systems (we have some dev environments), open them to the internet so the reviewers can log in and see how it actually works? Is that it?
(btw I'm asking this because our app review was rejected twice and I want to make sure I'm submitting everything they ask this time).
Thanks :)
I think the Login Review FAQ answers most of your questions. The key point:
Our review team will actually test how your app uses each permission on every platform you have listed in the settings section of your app.... You'll need to explain exactly how to test each permission or feature in your app so that we can make sure it works and follows our policies. We can't approve your app if we can't fully test how it integrates with Facebook.
In other words, it's not enough to just allow them to log in to your app, you have to expose all Facebook-related features to the reviewer.
To follow the app review steps we would have to create some users in our local systems (we have some dev environments), open them to the internet so the reviewers can log in and see how it actually works? Is that it?
Yes, though I'm not sure what you mean by "open them to the internet". You should be able to create a test user on your local system and link that account to a test Facebook user. Then you can have the Facebook reviewer use that test account for their review. (From the FAQ: "In the Items in Review section, you'll see a Test User (optional) section that allows you to type the name of the user you wish to be used in your review.")
I have more than few clients that would like to add facebook connect to their landing pages (managed by me). They are too many and not enough tech-savvy to manually create ad appid for each of them.
So my only solution is to usa my own appid to add facebook connect to all my clients websites, but as far as I know, Facebook doesn't allow to simply use the same appid on any domain.
How can I solve this? I can't find any documentation to solve my issue. Does anyone have a direction for me?
This has been discussed a couple o’ times before already – but I mostly commented on earlier questions, so let me write the whole thing up as a proper answer, for future reference.
[paraphrased] Multiple-client Facebook login via one single app id
Does anyone have a direction for me?
You probably rather don’t want to do that.
It is not really possible to run one simple app one multiple different domains.
As a workaround for only a few domains, people used to specify different domains for the different platforms – Website, Page Tab or Canvas App, plus Mobile alternative for Canvas – without actually using any of those platforms besides Website, which made the app usable on multiple domains as a website app. But since Facebook introduced their login/permission review process¹, you can’t do that any more – they expect you to present actual functionality on all platforms you have configured in your app.
You can kind-off use one single app for login on multiple domains – if you are willing to use only the server-side login flow, and to redirect users to one “main” domain (that gets specified as the app domain in the app settings) to login, and then from there back to the origin domain.
But this has several drawbacks:
It’s not what you’d call a “white label” solution. If your clients expect it to look as if users where logging in via “their” app, it should stay on their domain. Individual branding, in regard to stuff such as app name, app logo that shows in the login dialog, etc., would also not be possible. Additionally, app attribution – the link that shows up under content shared/posted via the app – would only link users back to the main domain, and not to your customer’s.
You would not be able to use the JS SDK for client-side API requests, or even just to embed it to render any of the FB social plugins that require an app id – the SDK checks what domain it is “running on”, and can not be tricked to accept a domain that is not specified in the app settings.
There could be privacy issues. An over-exaggerated example: Just because I as the app user decided to share my photos or videos I have on Facebook with your customer Our-Holy-Mother-of-Christ-Bakery.com, does not necessarily mean I want to share them with your other customer, amateurs-doing-all-kinds-of-nasty-stuff.xxx as well – but if they shared an app id for login purposes, I automatically would. Have fun writin’ the Privacy Policy (which is mandatory if you use FB login functionality, and FB also automatically checks if your app has got one) for that scenario ;-)
Finally, and most importantly: All your customers would be “sitting in the same boat.” If one of them, or in turn their website users, would publish spam via your app id, so that Facebook blocks it, login would not work any more for all of your customer’s websites. And if you decide only then, that setting up an individual app for each of your customers would be the better way to go, they would not be able to recognize their existing users any more, because of user ids being app-scoped since API v2.0 was introduced – so if users logged into this new app, that app would see a totally different user id. (And to rely on an email address as an identifier is risky, too, because you will not get one from the API for every user; for example if they registered using their mobile device.)
Edit: Plus, app/domain insights, as luschn mentioned in his answer.
¹ Yes, the review process has made it more laborious to set up multiple apps for multiple clients. But for apps that do the same stuff/use the same permissions in the same manner, you can refer to an earlier successfully reviewed app id to speed up the process a little. Also, screenshots of how f.e. posts made via the app look on timeline, and what UI components are used, as well as screencasts that you include in your submission could probably be used with little to no alteration.
Apps are not meant be used on several different domains, you will have to create a new App for each domain, i´m afraid. You can use the different platforms in the App settings to use different domains, but there are only a few so it´s pointless. Just create some screenshots and a tutorial for your clients, that´s how it is usually done.
Btw, it would be weird to authorize an App on a website, and the same App would allow you to be authorized on all other client websites. Also, insights are per App, so your clients may want to see their own insights and not the global insights of all domains together.
Many is not defined but i think for being a smart developer you need to create new app_ids for every project you need to use facebook connect. Just my opinion. It also allows you to monitor alot of stuff.
This question already has an answer here:
Closed 10 years ago.
Possible Duplicate:
Dec 5th beaking changes - facebook says app will be effect
I got an email that my app is impacting some new rules. Unfortunately english isn't my native language and I found no possibility to ask the facebook support - I'm not sure if I understood the email correctly. I hope you can help me:
Your desktop web game hosted primarily off Facebook currently
accesses user connections when authenticating and/or requests
additional permissions beyond age, email, and publishing permissions.
This is no longer allowed per Facebook Platform Policy I.13a:
Desktop web games off of Facebook.com may only use Facebook Login
(Authentication, excluding user connections such as friend list),
Social Plugins and publishing (e.g., Feed Dialog, Stream Publish, or
Open Graph). When authenticating, these games may not request
additional permissions other than age, email, and our Publishing
Permissions.
If your app is accessing user connections
(https://developers.facebook.com/docs/reference/api/user/) or asking
for additional permissions beyond age, email, and our Publishing
Permissions, please remove these requests. After December 5th, we will
place restrictions on your app if your app continues to access user
connections or request additional permissions other than
'user_birthday', 'email' or our publishing permissions such as
'publish_actions' or 'publish_stream'.
Do I understand this right, I can ask for following additional permission like email or publishing stream but nothing else?
I changed my login-url from
"scope=email,publish_stream,read_stream,user_games_activity"
to this:
"scope=email,publish_stream"
Is it now okay?
I also use $facebook->api('/'.$FacebookID.'/friends'); to get the list of friends and build a form where the user can send his friends an invitation. Is this not alowed anymore?
• Your Canvas/mobile game currently shares the same app ID with a
desktop web game off Facebook.com, which is no longer allowed per
Facebook Platform Policy I.13b:
(Games on Facebook.com and mobile must not share the same app ID with
desktop web games off of Facebook.com. You must not use Canvas apps to
promote or link to game sites off of Facebook, and must not use emails
obtained from us to promote or link to desktop web games off of
Facebook.com).
Please create a separate app ID for your Facebook Connect integration.
After December 5th, your Connect app will no longer be accessible if
it continues to share an app ID with its Canvas/mobile counterpart.
You have received this message because your app uses a Connect
integration. If you believe this to be an error, please reference the
developer docs to ensure your app is categorized correctly.
This one I don't understand at all. What and where can I do that? My app has a own URL and a canvas page at facebook. Would it be enough to remove the canvas page and only keep the direct URL?
I changed my login-url from "scope=email,publish_stream,read_stream,user_games_activity" to this: "scope=email,publish_stream" Is it now okay?
Yes, it should be ok now because according to the breaking changes "these games may not request additional permissions other than age, email, and our Publishing Permissions." So you should be fine.
I also use $facebook->api('/'.$FacebookID.'/friends'); to get the list of friends and build a form where the user can send his friends an invitation. Is this not alowed anymore?
/friends doesn't require any additional permissions, so I think it should be ok.
What and where can I do that? My app has a own URL and a canvas page at facebook. Would it be enough to remove the canvas page and only keep the direct URL?
Yes, you need to separate your canvas/mobile game from the desktop web game. Currently, they both have the same app ID, you can choose to either remove the canvas page entirely or create a new app for the canvas/mobile game and use that new app ID. Regardless, the end result is that only one of your games can use your exisiting app ID.
I know about test accounts, but during beta I'd like to allow access only to my friends, and then later friends-of-friends, and then only eventually Kevin Bacon and his friends.
That would probably suck, wouldn't it? The app would be listed (is there a way to prevent listing?) and someone I don't know might try it and get a "sorry, this is in development message." I imagine they'd be irritated and not come back.
From what I've read, only a few apps take off, but when they take off, they REALLY take off. Do developers just release these things fully baked?
Anyone start out with OpenSocial or other smaller-than-Facebook networks?
Any ideas for a soft, gradual, restricted roll-out?
Once you've set up your application, there is a setting in the Developer application control panel for your app: Your app -> Advanced -> Sandbox Mode.
Sandbox mode lets you restrict access to only those people listed as developers (under the Basic section).
In terms of expanding the app, Facebook doesn't provide much more flexibility that the Sandbox mode. Unfortunately, adding everyone as Developers of the app doesn't work very well for a beta, as people can access the application control panel once they are a developer. I ended up putting a whitelist of Facebook Ids into the front controller of my application for a previous beta, and it worked fairly well.
The apps are only listed in the App Directory if you submit them and they are accepted. There's no issue about preventing listing, it's something you have to apply for.
As for restricting users, you can accomplish it with a script in the application that checks whether the currently logged-in user is within your restricted user set. For example, if you only want friends of yourself, check whether the current user is friends with your user id. If not, simply display an error/message page or redirect them to the Facebook home page (or wherever). Add this check to the rest of the start-up logic run each page (such as connecting to your DB and authenticating with Facebook).
What I have done in some cases is keep a database table with the user id's of users who are allowed access, essentially a "whitelist". If the user isn't in the table, redirect them.