Question

So I successfully had my app posting scores to facebook using my account. But when I went to implement leaderboards, I tried playing with my wifes account. When it tries to submit her score, it returns “The remote server returned an error: (403) Forbidden”. Verified mine works correctly still. Can duplicate repeatedly.

Here is the WCF service.

<WebGet()>
<OperationContract()> _
Public Function postMyScore(id, score) As String
    'post user score using user's id, score and app's access_token
    Dim URL As String = "https://graph.facebook.com/" + id + "/scores"
    Dim webProxy As New System.Net.WebProxy(proxyURLremoved, True)
    Dim appToken = getAuthCode()

    Using client As New Net.WebClient
        client.Proxy = webProxy
        Dim reqparm As New Specialized.NameValueCollection
        reqparm.Add("score", score)
        reqparm.Add("access_token", appToken)
        Dim responsebytes = client.UploadValues(URL, "POST", reqparm)
        Dim responsebody = (New Text.UTF8Encoding).GetString(responsebytes)
        Return responsebody
    End Using

End Function

Again, the above works when I’m logged in as me, but not when I’m logged in using my wife’s account

And when I try to duplicate the post using the Graph API Explorer, I receive the following error (which may be by design for security)

{
  "error": {
    "message": "(#240) Requires a valid user is specified (either via the session or via the API parameter for specifying the user.", 
    "type": "OAuthException", 
    "code": 240
  }
}

Answer 1

I was confusing the permissions section in the App Center for the OAuth dialog with the data-perms attribute of the login button. They are not one and the same 😉

Now that my login button looks like this, everything works.

    <div id="fbLogin"><fb:login-button data-perms="publish_actions,friends_games_activity,user_games_activity" show-faces="false" width="200" max-rows="1"></fb:login-button></div>

Apparently app owners have all permissions by default.