I am trying to authenticate my application using Facebook PHP SDK. It is working fine, but for some users it will show the following users
{
"error": {
"type": "OAuthException",
"message": "An unexpected error has occurred. Please retry your request later."
}
}
It is creating a access token. But still it shows the errors.
I found the problem in my case.
The users that we receiving the error had activated https for their accounts and my application didn't have SSL activated. So I had to make sure that my app would work properly also over https.
In Facebook you can activate secure browsing by going to your account and (on the left) selecting "security" option.
It took many hours to find the reason and it was found by coincidence when I tried a simplified app that unlike the big one it complained about SSL. But it was the app who complained, Facebook kept sending a really vague error.
Related
I am trying to connect a bot to Facebook messenger, using Facebook developer tools.
https://developers.facebook.com/
I've created the Facebook app, and it's sent me the webhook to my server. However, when trying to call the Graph API when sending a message back to the user, I receive the following error:
FacebookMessaging:400 : {
"error": {
"message": "(#2) Service temporarily unavailable",
"type": "OAuthException",
"is_transient": true,
"code": 2,
"fbtrace_id": "AIWsRyUmPFnySGwb1Rgl4P6"
}
}
POST API,
https://graph.facebook.com/v10.0/page-id/messages?access_token=token
JSON
{recipient:{id:"id"}, message:{ text:"message"}}
I suspect it could be because my app is unreleased, but I'm trying to test it beforehand. Is there any other explanation for this, or how are you suppose to test an app before releasing it?
The same code is working for an older Facebook app that is released.
The issue was that the API call was missing the access token. Stupid mistake, but unusual error for missing the access token.
I already try and reproduce this problem. May be you use wrong access_token in this case. When you want to send the message by page, use should use page access token instead of user access token
Check out the diff here: https://developers.facebook.com/docs/facebook-login/access-tokens/
And flow here for get page access token: https://developers.facebook.com/docs/facebook-login/access-tokens/#pagetokens
It is clearly return you the response with type as OAuthException. If you find this error type in facebook garph api error handling documentation. You can see the first line of error codes is OAuthException. Also it is written there the resolution of this type of error in what to do column is, If no subcode is present, the login status or access token has expired, been revoked, or is otherwise invalid. Get a new access token.
If a subcode is present, see the subcode.
Well it is nice to see you get the answer on your own.
Earlier today, the Facebook login flow of our web application stopped working for some users. When we try to fetch the current profile, an error is returned. It claims that the access token we just generated by redirecting the user to the OAuth login flow has been rejected.
The reason given is:
The access token is invalid since the user hasn't engaged the app in longer than 90 days
To me, this makes no sense since we do not store the access token anywhere except for the current session and recreate it every time the user logs in with Facebook.
The stacktrace from Spring Social for the GET /me call looks like this:
ERR c.s.f.v.resource.AuthenticationResource Exception when connecting with Facebook
org.springframework.social.RevokedAuthorizationException: The authorization has been revoked. Reason: The access token is invalid since the user hasn't engaged the app in longer than 90 days.
at org.springframework.social.facebook.api.impl.FacebookErrorHandler.handleFacebookError(FacebookErrorHandler.java:85)
at org.springframework.social.facebook.api.impl.FacebookErrorHandler.handleError(FacebookErrorHandler.java:59)
at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63)
at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:775)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:728)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:702)
at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:350)
at org.springframework.social.facebook.api.impl.FacebookTemplate.fetchObject(FacebookTemplate.java:220)
at org.springframework.social.facebook.api.impl.FacebookTemplate.fetchObject(FacebookTemplate.java:215)
The issue is probably related to changes in the Facebook API, but I do not see how this affects the short lived access tokens we create on every login.
I ran into this issue when our integration tests logged in with a test user - the following JSON came back from the Graph API:
{
"error": {
"message": "The access token is invalid since the user hasn't engaged the app in longer than 90 days.",
"type": "OAuthException",
"code": 190,
"error_subcode": 493,
"fbtrace_id": "F/1z2AsTRx8"
},
"timestamp_microsecond": "2018-05-30 11:22:01.353949"
}
That was a bigger problem as our test users don't "engage" with the app as such. To fix this I had to:
Log into the FB developer site
Find the app in question
Look under Roles -> Test Users to find the right user
Click on the Edit button for the user and then click "Login as this test user"
Once I'd logged in, go to Settings -> Apps & Websites
Find the App in the "Expired" tab for apps the user had not interacted with for longer than 90 days
Click the "View & Edit" button on the expired app
Click "Renew Access" in the popup
Once I'd done all those steps my test user (and integration tests) worked again.
facebook responses:
Thanks for getting in touch. This is actually a known issue that we
are already tracking in another bug report.
I'm going to merge your report with the existing one, so we can deal
with the issue in one place. Please refer to this thread for updates:
http://developers.facebook.com/bugs/194772814474841/
My temporal solution was to use JS SDK, it is working correctly in my case...
Update:
The issue seems to have just been fixed by Facebook.
I filed a bug with Facebook and they are currently (5/3/18) working on a resolution.
There are several workarounds suggested here and in the bug comments. To summarize:
Add a new permission that you previously didn't ask for to force re-authorization
Catch the error and re-authorize the user manually via auth_type=reauthorize
Switch to JS SDK and use client-side login
I'm going for solution #2 as it seems to be the most straight-forward way.
I have found this link in FB docs:
Refreshing User Access Tokens
Which mentions that after 90 days users must re-establish their token, so in case of such error we should just redirect the user to register again.
They even mention that they remove tokens of non-active users in the top of this doc. Maybe they did a mistake and removed all users tokens.
Anyhow the solution is to redirect users to resubscribe.
The bug persist according to discussion
According to a user's comment of mentioned discussion, we revoked permissions of every user of our app and it worked. For this we used next graph api endpoint. We had to persist the users' facebookIDs.
Regards
TEMPORARY SOLUTION
For iOS you need to change SDKs code to support "reauthorize". In order to change source code you will need to download it using CocoaPods. Then copy the following functions over pods:
https://github.com/mavris/FacebookFix
Add Permission Code in your App
Likes
Android :
fbLoginButton.setReadPermissions(Arrays.asList(EMAIL));
IOS:
loginButton.readPermissions = #[#"public_profile", #"email"];
I am trying to pull Facebook Ads metrics through the Facebook Marketing API. The flow is basically that I wish to pull all the account ids of my company, and then loop over them, retrieving the insights for them individually.
However I have an error which I am not able to solve/comprehend.
When I attempt to make the API call (both in the Graph Explorer and my Alteryx workflow):
GET-> /v2.8/act_<Account_ID>/insights
I get the following error:
"error": {
"message": "(#3) Application does not have the capability to make this API call.",
"type": "OAuthException",
"code": 3,
"fbtrace_id": "BNevVWUExDg"
}
I must admit that I am quite at a loss what is causing this error...and actually also exactly what the issue is...am I lacking the right scope/permissions for my token?
With the same token I am able to correctly call the API to get a list of all adaccounts (GET-> /v2.8/me/adaccounts ).
Anyone have an idea what my issue might be?
You have to make sure that your particular access token has the permissions ads_management or ads_read.
This is from the Marketing API quickstart. https://developers.facebook.com/docs/marketing-apis
There are also rate limits on those API's, but I would expect a different error if that was the case.
I ran a POST instead of GET on the same endpoints, which gives me another error about not being admin on the account.
It appears that the user associated with the token (which is a long lived one) was only having analyst access to the account in Business Manager. After I changed it to advertiser it seems I can do the GET call.
In my case, I added a new development user in the roles page. Then I was trying to do OAuth. I got the error message "Application does not have the capability to make this API call."
Here's the way that I solve the problem while your application still in the development mode.
Go to Marketing API > Tools
Then select what token permissions you want. Press "Get Token" button.
Now, you can try to do OAuth again.
I'm trying to get an auth token for a user using OAuth.
Everything works fine and I'm getting the token wonderfully when the users tries to access the app using HTTPS, meaning from https://apps.facebook.com/APPNAME . However, if the user is coming from HTTP (which most users are) I get a 400 error from facebook when trying to get:
https://graph.facebook.com/oauth/access_token?code=XXXXXXXX-XXXXXX-XXXXXXXXX&client_secret=YYYYYYYYYYYYYYYYYYYYY&redirect_uri=https://fb.myapp.com/fb_connect/&client_id=ZZZZZZZZ
{
"error": {
"message": "Error validating verification code.",
"type": "OAuthException"
}
}
Why is this happening?
We have experienced a similar issues since Facebook began to require SSL certificates on apps.
OAuth 2.0 works correctly with PHP SDK 3.1.1. If you are using earlier versions, go to GIT HUB and upgrade.
However, even with 3.1.1, signed requests return NULL from http:// when Facebook users have not enabled secured browsing.
Solution is to 1. use javascript to add a redirect at the top of your script or 2. add a (a href =https://your app url*) link somewhere.
There is a major flaw in FB as all of FB links in the left side page menu are http:// when user has not enabled secured browsing.
I had the same problem but I found out that it was because the user did not confirm the e-mail address yet. So you won't get any token for a new user that has not confirmed his email address. Just in case, I thought it was useful for this topic.
A problem for me with the "Error validating verification code" were the redirect_uri.
Between the request for user authentication (returnung the code) and app authorization/authentication should be the same.
We have a Canvas Facebook App and for some time we get a strange error for some of the users that are trying to install (allow) our Facebook app. I mention this is happening only for some of the users and not for all! The error we are getting is "The remote server returned an error: (400) Bad Request." The graph API call we putted in a try catch block and this is what the logs says when I searched over them to see what went wrong. The graph API call is:
https://graph.facebook.com/oauth/access_token?client_id=XXX&redirect_uri=XXX&client_secret=XXX&code=code_received_from_facebook.
We received the code from Facebook and append it to the graph API call from above but it seems that for some users this is not working. Our redirect_uri parameters contains an URL to our Facebook App and contains also some parameters (example: http://apps.facebook.com/our_application_URL?cid=xxx&surveyid=xxx&messageid=xxx).
xxx = some values.
Did some of you confront with this kind of strange behavior? Working for some users but for other is not working? We are using the same code so nothing change between a successful installation and a unsuccessful installation.
Thank you for your help in advance!
Now that Facebook require SSL for applications your "redirect_uri" need to be https (i.e https://apps.facebook.com/myapp/), otherwhise you will get "Bad Request".
You probably got the error for only the users that had forced SSL but not the rest.