Question

I have devise/omniauth set up and now I would like to use the Facebook javascript SDK to login/ask for permissions and then route them to my omniauth callbacks controller.

This is what I have (coffeescript).

$('#fb-connect').live 'click', ->
  FB.login ((response) ->
    if response.authResponse
      window.location = "/users/auth/facebook/callback?code=" + response.authResponse.signedRequest 
    else
      console.log "User cancelled login or did not fully authorize."
  ), scope: "email, offline_access"

  false

But I’m getting an Invalid verification code format error. I’m assuming it’s because the code param expects something other than the signed request?

Update

So it looks like I need to pass in the authorization code, but I can’t find how. The direct url example shows that you can specify response_type=code to get the authorization code but I don’t know how to do that using FB.api. Any ideas?

http://www.facebook.com/dialog/oauth/?
  scope=email,user_birthday&
  client_id=123050457758183&
  redirect_uri=http://www.example.com/response&
  response_type=code

Answer 1

Just incase anyone else stumbles across this question you don’t need to pass any parameters to your controller when using Devise/omniauth… the following works perfectly

$('#fb-connect').live 'click', ->
  FB.login ((response) ->
    if response.authResponse
      window.location = "/users/auth/facebook/callback
    else
      console.log "User cancelled login or did not fully authorize."
  ), scope: "email, offline_access"

  false

EDIT

If using a lesser version or to get around exception thrown when both param and code are missing the following inline js works with an onclick.

<script>
  function fb_authorise(){
    FB.login(function(response) {
      if(response.authResponse) {
        window.location = "/users/auth/facebook/callback?signed_request=<%= params[:signed_request]%>"
      }
    }, {scope: "email, offline_access"});
  };
</script>

So in answer to your original question you were using the signed_request param and then adding to the URL with code= not signed_request