Question

I’m trying to implement Facebook authentication in our web app, with server side processing of the Facebook cookie. We use the JavaScript SDK to perform our login and set the cookie.

Somehow, however, the Facebook SDK does not appear to set our fbsr_APPID cookie (or any cookie whatsoever). This is the CoffeeScript code:

window.fbCallbacks = []

   # Create initialization function
window.fbAsyncInit = ->
  fbConfig =
    appId:      '<APPID here>'
    channelUrl: '/assets/channel.html'
    status:     true
    cookie:     true
    xfbml:      true

  FB.init fbConfig

  cb() for cb in window.fbCallbacks

# Set it up
((d)->
    id  = 'facebook-jssdk'
    ref = d.getElementsByTagName('script')[0]
    return if d.getElementById id

    js          = d.createElement 'script'
    js.id       = id
    js.async    = true
    js.src      = "//connect.facebook.net/en_US/all.js"
    ref.parentNode.insertBefore js, ref
)(document)

We let Facebook perform the login via the provided login widget:

<div class="fb-login-button" data-show-faces="true" data-scope="publish_stream"/>

Some extra information:

• This was tested in Chrome stable and canary as well as IE9, both on localhost and 127.0.0.1, with and without the –enable-file-cookies set (for what it’s worth). I’d say that means it’s not a browser issue.
• I’ve tried fiddling with the channel file, but it seems perfectly accessible where it is now.
• Setting a cookie in my own code from JS works like it should.
• The JS SDK loads fine, because my login widget is properly decorated, and even shows that I’ve logged in already after I did.
• No errors are reported in the console. It’s completely blank.
• Replacing the CoffeeScript with a copy from the initialization code JavaScript example on the Facebook Developers does not make it work either.

So what’s happening? Why isn’t Facebook setting my app cookie?

For reference, here is the JavaScript generated by the CoffeeScript above:

(function() {
  window.fbCallbacks = [];
  window.fbAsyncInit = function() {
    var cb, fbConfig, _i, _len, _ref, _results;
    fbConfig = {
      appId: '<appid>',
      channelUrl: '/assets/channel.html',
      status: true,
      cookie: true,
      xfbml: true
    };
    FB.init(fbConfig);
    _ref = window.fbCallbacks;
    _results = [];
    for (_i = 0, _len = _ref.length; _i < _len; _i++) {
      cb = _ref[_i];
      _results.push(cb());
    }
    return _results;
  };
  (function(d) {
     var id, js, ref;
     id = 'facebook-jssdk';
     ref = d.getElementsByTagName('script')[0];
     if (d.getElementById(id)) {
       return;
     }
     js = d.createElement('script');
     js.id = id;
     js.async = true;
     js.src = "//connect.facebook.net/en_US/all.js";
     return ref.parentNode.insertBefore(js, ref);
  })(document);
}).call(this);

Answer 1

It appears I misunderstood the SDK. The login button widget does not actually set a cookie locally; it manages authentication and access through Facebook and JavaScript entirely and therefore does not allow you access to an authentication token on the server.

Using the JS SDK’s FB.login() function did set the cookie.