Question

I’m having some trouble getting my C# Facebook canvas app to determine if a user has authorized my app.

The problem is actually only occurring on a secondary page. My app initially checks on the landing page and properly determines that the user has validated the application.

Short overview of app:

1. User likes app.
2. User authorizes app.
3. User sends info to a friend (via Facebook notification)
4. Friend of user visits app and gets information.

So steps 1-3 work. Step 4 is where I’m having some issues.

I’m calling a method called “HasAuthorizedApplication” to ensure that the user has authorized the app before trying to get data from the API.

public bool HasAuthorizedApplication()
    {
        bool returnValue = false;

        try
        {
            if (FacebookWebContext.Current != null)
            {
                returnValue = FacebookWebContext.Current.IsAuthorized(Scope.Split(','));

                if (returnValue)
                {
                    AccessToken = FacebookWebContext.Current.AccessToken;
                    HttpContext.Current.Session["accesstoken"] = AccessToken;
                }
                else
                {
                    HttpContext.Current.Session["accesstoken"] = null;
                }
            }
        }
        catch
        {
            returnValue = false;
        }

        return returnValue;
    }

“Scope” is just the permissions I’m asking for: “publish_stream,email”

So in step 4, the ‘friend of the user’ clicks on the Facebook notification and hits the landing page of the app. It checks for authorization and if the friend hasn’t authorized, the auth dialog is presented.

After authorizing, the app redirects to the secondary page and before I get the details of the notification from the graph, I check again to ensure the friend has still authorized the app.

Unfortunately, when I call it this time, “FacebookWebContext.Current.IsAuthorized” always returns “false.” I note that the “AccessToken” and “SignedRequest” are null at this time. I attempt to redirect back to the authorization dialog, but as the friend has already validated, it doesn’t show to the user. But each time they return back to my secondary page, the “IsAuthorized” call returns false. (and if I try to just get the data, additionally returns false)

My call to get the data surrounding the Facebook notification:

public dynamic GetData(string dataId)
    {
        if (HasAuthorizedApplication())
        {
            var fb = new FacebookWebClient(AccessToken);
            dynamic data = fb.Get(dataId);

            return data;
        }

        return null;
    }

Where “dataId” is the id of the notification.

Admittedly, I don’t know much about how the interactions between the Javascript and backend work. I additionally have the following Javascript on both the landing and secondary pages:

<script type="text/javascript">
            FB.init({
                appId: '<%=APPID %>',
                status: true, // check login status
                cookie: true, // enable cookies to allow the server to access the session
                oauth: true,
                xfbml: true // parse XFBML
            });

        </script>

And ideas why it would work properly on one page and not another?

Thanks!
Craig

Answer 1

I know this isn’t exactly the answer you are looking for, but FacebookWebContext is part of the Facebook C# SDK V5 and is being deprecated. There are several issues with it, most importantly that it depends on ready Facebook’s auth cookies. Facebook recently made a change to their policies that indicated that developers should no longer read the Facebook cookies directly as they may change at any time. As such we have removed these features in V6 of the Facebook C# SDK.

That being said, you should handle nearly all of what you are trying to do above with the Facebook Javascript SDK on the client rather than with the C# SDK on the server. You can use the Facebook C# SDK on the server to perform final validation.

As such, I would recommend you upgrade to V6 of the Facebook C# SDK which does not use the Facebook cookies or contain the FacebookWebContext object.

You can find the full documentation for the Facebook C# SDK at http://csharpsdk.org.