Home/ Questions/Q 6795171
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T18:18:41+00:00

I’m working on a site that is using Facebook authentication and friends, but I’m

  • 0

I’m working on a site that is using Facebook authentication and friends, but I’m not ready for it to be publicly visible. It seems like if I put a password on the site’s directory, Facebook’s calls to my server won’t be able to get in. Is there a way to provide FB with user/psw credentials for the site — just http basic authentication or something comparable, I guess — so that it will be able to get in?

EDIT BASED ON CLARIFICATION AND MORE EXPERIMENTATION:

There are looking to be two parts to this:

  • There are no problems with Facebook Connect. When the user visits the page of the protected site, they’re presented with the authentication panel, and they then authenticate (or don’t). If they get it, the connection/login follows, and all’s well, since the connect information is presumably coming back along the same http connection that’s just been authenticated. (I’m a little fuzzy on these parts of http work, but I think that’s mostly correct.)

The REAL problem I’m facing, as I just realized (sorry; early Monday morning / long weekend) is how calls from the realtime API get in. These calls just sort of arrive from out of the blue, and so there’s no authenticated path into the server. @Martey’s point about doing authentication (posted to an earlier version of the question) based on ip address looks promising there, but I’m still wondering if there’s a way to get FB to send along user/psw with that.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    An alternative would be to use authentication based on IP addresses. By only allowing your address and Facebook’s, you would prevent others from accessing the site, but still allow any callbacks from Facebook to arrive.

    In response to the updated question: If it is possible to add HTTP Basic authentication to a callback URL (i.e. http://USER:PASSWORD@example.com/), you would have to do so by adding the username and password directly to the callback_url parameter when creating a real-time subscription. Whether or not this will work, however, is dependent on Facebook being able to parse your callback URL and correctly use Basic authentication when communicating with your server.

    • 0