i've run into a problem.
I have custom page tab, and current user viewing on it.
I ask user to grant extended permissions to his profile (using Facebook.showPermissionDialog).
If he grants permissions, theoretically, i would have access to the Graph API and other stuff.
But when i parse new signed_request param from Facebook, i get oauth_token, bound to current page tab, not to user profile. In other words request to Graph API method 'me' gives me my custom page profile. And I want to get user's profile! How should i get access to it?
How to get access to user's Graph API on Facebook tab?
I've figured out how it works. After the user grants permissions, Facebook sends signed_request of current user (and his ID as well), when calling page on my server via Ajax. When the page loads statically - you get signed_request of page tab. Hope it will help somebody.
Tab is much more limited than a regular app. It doesn't know who is visiting it unless they interact with the tab. Basically it was made to emphasize that a tab is designed to be useful to a user who installed it, not to visitors. From docs:
It doesn't know who the viewing user is when the user first visits the tab. Facebook sends the fb_sig_user and fb_sig_profile_user parameters, both containing the profile owner's user ID.
If a viewing user interacts with the tab (like submits a form, takes an action that causes an AJAX load of new content, or follows a relative URL that loads on the tab), that user's UID is sent to the application as the fb_sig_user parameter, the profile owner's user ID is sent as the fb_sig_profile_user parameter. The viewing user's session key is key is sent only if the user authorized the application.
Applications use the owner's session key on the owner's application tabs.
Related
I'm developing a Facebook Page Tab App. The files are located on my own server and i've created a Facebook App.
Now i'm trying to access the user's first name and i found different ways to get user informations, e.g. the $signedrequest (for the user ID) or the Facebook PHP SDK.
So do i need the SDK, e.g. for Graph API calls, or are there other ways to get informations from Facebook in my Page Tab App?
Using the SDK i get a lot of errors like An active access token must be used to query information about the current user., even if the user is already logged in.
If the user have not signed in to your app you will not get the user name or user id from the singend request parameter. It will give you information if the user likes the page, is admin of the page and additional app_data.
Using the php-sdk you can use the getLoginUrl() method, https://developers.facebook.com/docs/reference/php/facebook-getLoginUrl/, to get the access token needed to fetch user name, user id etc.
With the changes for Facebook Apps coming on October 1st, I am having trouble confirming that our Canvas/Tab app will/will not work as expected.
When a user first loads the tab with the app, I'm expecting facebook to send me parameters of "fb_sig_profile_id" (which I believe should be the ID of the Page) and "fb_sig_app_id" (the ID of the APP).
I DO NOT need/want to authenticate users or access UserData/Graph etc. I am simply displaying content on my end based on these parameters.
If this is no longer the case and Facebook is not going to be sending me these parameters, can someone point me in the direction of how I can get this data.
Thanks
When building Apps On Facebook kind of apps, Facebook will send a signed_request which will contain the data you need:
When a user navigates to the Facebook Page, they will see your Page
Tab added in the next available tab position. Broadly, a Page Tab is
loaded in exactly the same way as a Canvas Page. Read more about this
in the Canvas Tutorial. When a user selects your Page Tab, you will
receive the signed_request parameter with one additional parameter,
page. This parameter contains a JSON object with an id (the page id of
the current page), admin (if the user is a admin of the page), and
liked (if the user has liked the page). As with a Canvas Page, you
will not receive all the user information accessible to your app in
the signed_request until the user authorizes your app.
Reference.
I am making a Facebook App which will be only used for Facebook Pages.
I need to provide a post-authorize URL to make some action on Database when a user adds the app to their page.
But i cannot find any place to enter the URL.
Someone can help me ?
EDIT: User will only Add App to their page from Application Profile Page on FB
There is no such thing as "post-authorize URL" for applications working as Page tab. You will never know identity of user who added your application on page via application profile page.
Adding application to page doesn't mean that owner of page authorized the app.
Signed request contain information about page and user interacting with page tab application so you may know if user is admin of the page, liked the page and some additional details, it will include personal details only if user authorized application which should be done as separate step.
The way I'd do it:
List all the PAGE ID on which your user is admin:
FQL: select page_id from page_admin where uid=me()
When a page load your application, using the data contained in the signed_request POST parameter, look if the current page is a new page (just assign a boolean in the database to know if the page is already using the application or is new), and if the page is in fact using the app for the forst time, look if you have the admin in your database (remember? you have linked the PAGE ID and the ADMIN ID together in #1)
From there, you can do whatever you want: display a "application not yet authorized" instead of the normal app in order to wait for the user to pay you, etc...
How can you detect if a user previously authorized a tab application, without showing the user an authorization dialog? This is a user experience concern. We don't want to throw the user at an authorization dialog without a call-to-action, but we don't want a call to action to be shown to log the user in if the user previously authorized the app.
Here's the scenario. A tab application is hosted on a page that has several other applications. In Facebook, the 'Like' button does not work at the tab level but on a page level, so a user may have liked a different application without having seen the current application. Therefore, if any 'Like gate' is used on the landing page of a tab application, and authorization is required to use the app, then when we log the user in the user will be immediately shown the authorization screen without a call to action, unless we can detect that the user previously authorized this application.
You could use the javascript SDK and check the login status to see if they have authorized your application. If they have, you could redirect with javascript elsewhere or make the calls you need. If they haven't you could then show the call to action on your page. Something like:
FB.getLoginStatus(function(response){
if(!response.authResponse){
// redirect to authorization page
top.location.href="http://www.facebook.com/dialog/oauth?client_id=appid&redirect_uri=http://facebook.com/somefanpage";
// or instead show a call to action div
} else {
//load fan page specific content
}
});
But this will only tell if you if they are currently logged in and authenticated with your application or not. The only way you would be able to tell if this is a returning user vs a brand new user is if Facebook sent over the userId in the signed_request like ifaour mentioned (then you could call /userId/permissions with your app access token or look up in your database), but Facebook most likely won't send the userId since your users probably aren't authenticating with your individual tab application but a different shared application key.
Well Facebook will send the user id in the signed_request only when the user authorize your application. So as long as that piece of information is missing then this means the user didn't authorize your application yet i.e. show the auth dialog (or redirect to auth screen)!
More about this in the Page Tab Tutorial:
Integrating with Facebook APIs
When a user navigates to the Facebook Page, they will see your Page
Tab added in the next available tab position. Broadly, a Page Tab is
loaded in exactly the same way as a Canvas Page. Read more about this
in the Canvas Tutorial. When a user selects your Page Tab, you will
received the signed_request parameter with one additional parameter,
page. This parameter contains a JSON object with an id (the page id of
the current page), admin (if the user is a admin of the page), and
liked (if the user has liked the page). As with a Canvas Page, you
will not receive all the user information accessible to your app in
the signed_request until the user authorizes your app.
Forgive me if this has been asked before, but I was unable to find an answer to what seems a simple question. I have an app that is authorized to a user & user's fan page via a process from a website I've constructed. The process is this:
Visit Website --> authorize website to view list of fan pages --> Select Fan Page to install app to --> Authorize app to user account --> Authorize app to Fan Page
I've got all that working (a process, let me tell you), and everything functions as intended. I'm working on an admin interface to manage the app which is not housed in the Canvas App location but on the website itself. I haven't found a way to figure out if the app is installed or not. It appears that the Graph API / FQL doesn't support this.
My two issues are:
I have the user id & the fan page id but I can't figure out whether said fan page has my app authorized or not. Depending on this answer will determine whether I show the "Install This App" panel or the Administration panel.
I've read that the best method is to store the userid when the app is initially authorized, but after the app is authorized, the user is sent to the Fan Page's Wall and I can't figure out how to notify my iframe app.
[edit] I misunderstood your question and thought you had less implemented than you seem to have: If you have manage_pages permission for a user, you can get the Page access token for each of their pages, and access a list of apps currently installed as tabs on that page - the instructions are at https://developers.facebook.com/docs/reference/api/page/#tabs
[/edit]
Each request made to your app's 'page tab url' will include a signed_request parameter.
The method to decode it is explained at https://developers.facebook.com/docs/authentication/signed_request/ - when your app is loaded on a page tab you'll get the 'page' parameter.
So:
The first time the tab provided by your app is loaded on a new page, you can detect the page ID from the signed request.
This callback will also tell you if the user currently looking at the page tab is an admin of that page (which can be useful for your own edit interface, if applicable)
If you haven't already got an interface where the app user tells you which pages they admin you can get a list of all the pages that user administers by accessing the 'accounts' property on their user object (/me/accounts in the Graph API) once you have the manage_pages permission
can you keep track of who has the app authorized in a database on your website?
i.e. call a script on your website server from your app that returns whether or not the user has authorized the app.