My application uses the "https://graph.facebook.com/me" request with an OAuth token to obtain properties about the user. Email address is one of the properties we need, and we do explicity request that permission when we request access.
It's working fine 99% of the time, but on a few occasions the response comes back without any object in the jSON data named "email".
Is there an explanation as to why this might happen, such as a way a user could grant us permission but still block their email address? Or could it be found under another key?
Thanks.
Short answer: Not all users have an email address available and those who do may not have a valid, reachable email address
The documentation for the email field of the user object ( https://developers.facebook.com/docs/reference/api/user/ ) clarifies the expected behaviour here, which is:
"this field will not be returned if no valid email address is available"
There are a number of circumstances in which you may think a user should have an email address returned but they will not. Some common reasons:
No Email address on account
No confirmed, verified email address on account
User entered a security checkpoint which required them to reconfirm their email address and they have not yet done so
Users's email address is unreachable
You also need the email extended permission (which users can choose not to allow), even for users who have a valid, confirmed, reachable email address on file.
The mobile signup form at http://touch.facebook.com/r.php allows you to signup with an email address or phone number. So I don't think all Facebook users have an email address stored with them.
The user can revoke the email address permission on the app privacy settings page without revoking the full application. You could first call /me/permissions to make sure the email permission is still granted.
If you are using facebook SDK 2.4 or higher you need to add "fields" in the strategy
Below is an example for oAuth library.
FacebookStrategy.php line 131
BEFORE:
$me = $this->serverGet('https://graph.facebook.com/me', array('access_token' => $access_token), null, $headers);
AFTER:
$me = $this->serverGet('https://graph.facebook.com/me', array('access_token' => $access_token,'fields'=>'email,name,first_name,last_name,age_range,gender'), null, $headers);
Regardless of the field list, if you want to get more information that is not by default provided by Facebook, the permissions need to be in the "scope" array.
Default data provided by SDK includes: email, public profile, user_friends
Had the same problem and discovered that in the rare cases where this happens the user did not have a primary E-Mail-Address defined (although 2 Addresses were registered). We're not able to reproduce such a costellation, since normally it is not possible not to have a primary e-mail address.
Can anyone confirm something similar?
Missing email field happens where user doesn't confirm his primary address via clicking link from activation message.
Related
I am implementing an email verification service, with the purpose of confirming that the person registering is indeed the owner of that email address (specifically, that they work at the organisation that the email domain belongs to).
I will send an email post-registration with a single-use link in it that will set their status to verified = 1.
Users can choose to register and log-in using either a simple email/password combination, or by using the Google Sign In service.
My question is: do I need to verify the ones that have registered with Google Sign In? In order to provide their email address to me, they had to sign in with Google, who then confirmed the address. Is there anything I've missed here, or can I immediately consider these users to be the verified owners of these addresses?
If you are using google sign in there is no need to verify the user.
Whereas if have your own login system, then you must verify the email because
if the email is not verified then you cannot have forgotten password feature through email
and also the user might not have actually had the email so anyone else could create the same email and if you have forgotten password through email someone else could easily access others data.
For some users in our application, the email field returns NULL even if the user has granted the email access to the app.
When we check the scope parameter and the validity of the user Token thanks to the Debugger tool, everything is ok. The permission email has been accepted.
But when we ask the Graph API for the email of the user with the valid user token, it does not appear at all.
Is there a way a user could prevent an app from getting his email even if he granted the email permission?
Thanks
I had the same problem and I think I found out why:
If the user has an unconfirmed email in Facebook (i.e. Facebook sent him a validation mail to the user's email address but he didn't respond) Facebook WILL NOT pass that email to your app even if he gave you the email permissions.
So what I did is use his or her Facebook email if the user has a user name (i.e. userName#facebook.com).
I have the same issue. It is working fine on my localhost, i am using php SDK for facebook login and when i submit my request it's return all the fields like email,name etc of the user but on server somehow it is not working.It will not returns user email.
I have done lots of R&D on that and i have the solution for the issue. :)
$profile = $facebook->api('/me?fields=email,first_name,last_name');
if you are using php-sdk just passes fields like this it returns the email,first_name etc.
Hopes it works for you all.
thanks.
All you need to know:
1) Link 1
Some possible reasons:
No Email address on account
No confirmed email address on account
No verified email address on account
User entered a security checkpoint which required them to reconfirm their email address and they have not yet done so
Users's email address is unreachable
You also need the 'email' extended permission, even for users who have
a valid, confirmed, reachable email address on file.
2) Link 2
Note, even if you request the email permission it is not guaranteed
you will get an email address. For example, if someone signed up for
Facebook with a phone number instead of an email address, the email
field may be empty.
Facebook does not send the email if the user has logged in with their phone number.
View the comments on https://github.com/mkdynamic/omniauth-facebook/issues/61 for more info.
You must give email permission along with the auth button.
authButton.setReadPermissions(Arrays.asList("email"));
In some cases Facebook may not have a valid email address for a user:
email: string containing a valid RFC822 email address - note: this
field may be null if no email address is available for the user
see https://developers.facebook.com/docs/reference/api/user/
#ozba solution is not applicable because facebook now shows an alert message when user has an unconfirmed email address. So, if you're having this problem it's more liking that the user had signed up using phone number.
Some possible reasons:
No Email address on account (only phone number)
No confirmed email address on account
User entered a security checkpoint which required them to reconfirm their email address and they have not yet done so users's email address is unreachable.
Check: https://developers.facebook.com/bugs/298946933534016
According to the documentation:
Note, even if you request the email permission it is not guaranteed you will get an email address. For example, if someone signed up for Facebook with a phone number instead of an email address, the email field may be empty.
That would explain why some users have a null email!
Facebook will provide you a user's email id if and only that user has a confirmed email id associated with his account. If your app can retrieve email id for some users, problem may not with the Developer.
I have read previous responses but though some of them true like if the user has not email confirmed but a mobile phone number, many times this error happens for ignoring how to request the information using FB api graph. Let's say your login was successfully done, and you now have an access token and user id an so on but still, cannot see email and other fields you are interested in. Go ahead using this request after confirming login status as connected:
FB.api(
'/me',
'GET',
{"fields":"id,name,birthday,email,about,cover"},
function(response) {
// Insert your code here
}
);
depends on permissions you requested you now will be able to catch further information according to your needs.
you can try this it will work
String email = user.getProperty("email").toString();
String safeEmail = user.asMap().get("email").toString();
You need one more permission from facebook.
include (about_me) permission to the facebook dev setting and also in your app or code..
Just you need to add more permissions to whatever data you want from Facebook object about your user.
Facebook API
$loginUrl = $facebook->getLoginUrl(
array(
'req_perms' => 'email'
)
);
Update
This was reported to Facebook via https://www.facebook.com/whitehat/report/ on Dec 16th 2013 and Facebook responded on Dec 17th that the bug has long since been fixed.
I have retested this with my Facebook account (that I still haven't verified the email address on) and when using the Grap API Explorer tool it is not possible to get the email address of this account using the Graph API or using a FQL query.
Conclusion: The email address you get from Facebook using the Graph API or a FQL query is a verified email. If an account hasn't verified it's email yet it's not possible to get it.
Original Post
I am making a web app with SSO that is offering the user to sign in with either Google or Facebook. I would like users who have both types of accounts to show up as the same user in my system regardless of which identity they log in with. To achieve this I'm thinking of using the email address as the identifier to know if I should create a new account or if the user already exists.
To not introduce any security problems I must know that the email address is verified and actually belongs to the user. For Google the userinfo API can tell me if an email is verified or not, so there's no problem here. But I can not find anything like this in the Facebook Graph API.
Is it possible to know if an email address is confirmed on Facebook?
I know that there is a verified field, but that only tells if the account is verified and not the email address.
At first it looked like you are only able to use the Graph API for accounts where the email address has been confirmed. If the address wasn't confirmed I just got an error telling me that I had to confirm the email address first before being able to sign in to any third party site.
However this does not seem to be true for all accounts. In some cases it's possible to get accesses to all parts of Facebook even if you don't have a confirmed email address. One example of this is when you sign up with a #myopera.com mail address.
When you sign up to Facebook with a #myopera.com email address you get a message that your account has been temporarily locked as soon as you submit the sign up form. To continue you need to provide your phone number to verify your account and to "keep Facebook safe and free from spam" (sorry for the Swedish in the screenshot, this was before I could get into Facebook and change language to English):
When you provide your phone number you are logged in and Facebook doesn't nag you any further about that you have to verify your email address.
The only place where you can see that your email address is not yet verified is on the settings page:
The Mobile Settings that is usually not accessible before you have verified your email address is available and lists the phone number entered during sign up:
In addition to this it is also possible to log in to third party sites with an unconfirmed email address:
When I connect to the graph api with this user I can get the unconfirmed email address and the verified field returns true as expected since I have verified the account by adding a phone number. So obviously I can't trust that the email address I get from Facebook really belongs to the user that has the Facebook account.
Is there any other way of knowing if the email address is verified or not or do I have to verify it myself if I want to use it for identifying the user?
I was looking for an official Facebook statement regarding this issue and finally i found this: https://developers.facebook.com/docs/facebook-login/multiple-providers#postfb1, which clearly says that developer should not rely on the fact that email address is verified.
I've never used it, but you may be able to check with a FQL query of the user.email_hashes: http://developers.facebook.com/docs/reference/fql/user
I am using the Graph API and able to get users' email addresses successfully.
I am wondering if i can assume that i will ALWAYS get a user's email address back, or if i need to plan for some fringe scenario where the user's permissions are set or something and i will be unable to get the user's email address.
Thanks.
As long as you ask for the email permission and that the user accept it, you'll always get the user email. However, you'll need to foresee the case where the user don't accept it.
I'm using Register with Facebook as one of the ways to log in to my web app, and expressly ask for the "email" permission..
On login, some of the user data ($facebook->api('/me')) is stored into the users database, however, sometimes the email field just doesn't exist - is this a common problem?
Just a guess...
The facebook documentation says:
note: this field will not be returned if no valid email address is available for the user
Source: https://developers.facebook.com/docs/reference/api/user/
So when an email address become invalid (users who haven't used facebook in years and have destroyed/changed their email address since for example), facebook may stop returning this field.
5% of invalid address may sounds big, but if I check my facebook friends, I think more than 5% of them never use their account, and I wouldn't be surprised if the address they used when they signed in is now invalid.
Users don't always have to provide an email address in order to use Facebook. They can also sign up via SMS, though it's far less common.
In short, FB won't always have an email address, so can't serve it to your app.
Try:
// Just to make sure email are permitted
//$facebook->getLoginUrl(array('req_perms' => 'email'))
// Request email
FB.api('/me?scope=email', function(response) { /*...*/ });
Or:
$email = $facebook->api('user_id?fields=email');
PROBLEMS:
The user changed the visibility of its email address to "only me" and thus you have no way to get it.
The user registered with SMS instead of email as mentioned in the previous answer.
ALTERNATIVE:
If you absolutely need to contact the user but you cannot get its email address nyou can still get its Facebook email (everybody has this email): "user_name#facebook.com".
If the user uses a POP server he will directly receive the email in GMail or others, if not he will receive your email as a private message. The only drawback if this method is that your email must be "plain/text" and not "HTML".
One thing is Users don't always have to provide an email address in order to use Facebook(could have registered through mobile)- as mentioned by Colm. Apart from this-
Please check that if the user has definitely granted you the email extended permission or it hasn't subsequently been revoked. To have a check on this you could use the permissions api-
/USER/permissions
I had similar problem & I found the cause for this. This problem occurs for users who have not set their Primary Email Address (They have many email address but they haven’t pointed out which is their primary email address) under General Account setting tab.
I tried using such accounts on various famous sites which has Facebook login & even they couldn’t retrieve the email address from such accounts.
So, its not the problem with the code(Assuming u have asked for permissions). We just have to handle such scenarios & let users know that we didn’t receive their email address. Like Klout does.
Thanks
In addition to what #Jigar Jain wrote above, users can actually uncheck the email permission during the sign inflow. If that's the case, his/her email address will not be returned by Facebook.
It's up to you to implement a logic that makes login unsuccessful if user unchecks the email permission, to force your users to choose another login method that will guarantee that a return of user's email address.
It is not mandatory for someone to give their email address while signing up with Facebook. An alternate approach would be to ask the user to link their email id in the Facebook account settings. That way you can fetch the email id, if that's a mandatory field in your DB. Otherwise you can continue with the id provided by FB which is unique.