Facebook FB.logout not working in IE - django

I am working on a django website which also allows users to sign in using their Facebook account. The login works fine, however I am not able to logout using Internet Explorer. The code seems to work fine on Firefox and Chrome.
Heres the code
function logoutFBUser()
{
//logout user from website and Facebook and reload
alert ("called FB logout");
if (FB.getAuthResponse())
{
alert ("has auth response");
FB.logout(function(response)
{
window.location.href = '/accounts/logout?next=/';
});
alert ("logged out of FB and redirected");
}
else
{
alert(" no auth response");
window.location.href = '/accounts/logout?next=/';
}
}
In Firefox, I get the alert of has auth response, however in IE, I get the alert no auth response. If I only use FB.logout without FB.getAuthResponse then the function hangs when it hits FB.logout.
What am I missing?

Finally solved this. I debugged into the javascript for FB.logout and for some reason it doesnt have the access_token which is why the call to FB.logout fails. Researching the Facebook documentation led me to this URL which I used for the logout process on my website successfully
Logoutlink from Facebook Documentation
https://www.facebook.com/logout.php?next=REDIRECT_URI&access_token=LOGGEDINUSER_ACCESS_TOKEN
Needless to say, I am using this on the serverside, so no need to use javascript any more.
Please refer Facebook Authentication documentation for more information.
http://developers.facebook.com/docs/authentication/
Thanks for all the help

Related

Error when trying to authenticate via Django allauth social login when using in app browser on Instagram or Facebook messenger

My website work fine in a regular browser, but when visiting it trough a in app browser from either Instagram of faceboon messenger it stops working.
When visiting trough the faceboon messenger app nothing happens when clicking the Facebook authenticate button, and clicking the Google button raises the error:
Error 400: redirect_uri_mismatch
When visiting trough the Instagram in app browser the Facebook login seems to work as expected but the Google login raises the same 400 error.
Using the slack in app browser things work as expected.
Any ideas what the issue can be here and how to resolve it?

Open Website From App And Redirect Back

We have an app that requires a user to make a payment. We have a third party provider that handles the payments. On our website, when the user makes a payment they get directed to the payment portal on the third party's website and after payment, they get redirected back to our website.
I have been tasked to implement the same thing in our iOS Swift 3 app. I have an idea of what I want to do but I am not quite sure how to do it. I started by thinking that I could open the user's browser with a POST request (I know now that I can't) and then using Universal Linking, grab the redirect with the app once payment is complete.
So since I cannot do POST requests on the user's browser, I thought I would implement a UIWebView in my app. Basically I have the code to do this. My question is. How do I capture the redirect from the UiWebView? As far as I can tell, upon successful payment the UIWebView will stay active and the page will redirect, showing our website inside of our app. This is not what I want.
Can anyone explain a better way of doing this? No Code required, but will be greatly appreciated.
Yes, Its possible and many apps are doing the same.
There are various methods to do it but What I am doing, I can share.
I am opening payment page in webview and after success on payment page. The page is redirecting to Success page with SuccessURL. When SuccessURL/FailedURL(Predefined) started loading, I take user back to native app.
func webView(webView: UIWebView, shouldStartLoadWithRequest request: NSURLRequest, navigationType: UIWebViewNavigationType) -> Bool {
if request.url == "sucessURL" {
//do whatever you want
return false
}
if request.url == "failedURL" {
////do whatever you want
return false
}
else {
return true
}
}

Facebook server-side login, CORS

I'm implementing a web site with FB server-side login as simplified steps below:
A simple button triggers JS script which calls my backend API https://localhost/fblogin
function sendFbLoginData() {
$.get("https://localhost/fblogin", function(data, status) {});
}
In the backend handler of /fblogin the user is redirected to FB login dialog for requesting permissions and access token.
func (ct *LoginController) FbLogin() {
url := "https://www.facebook.com/dialog/oauth?client_id=xxx&redirect_uri=https://localhost/fboauth2cb&response_type=code&scope=public_profile"
ct.Redirect(url, 302)
return
}
At browser console shows error msg:
XMLHttpRequest cannot load https://www.facebook.com/dialog/oauth?client_id=xxx&redirect_ur…e_type=code&scope=public_profile. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://localhost' is therefore not allowed access.
After googling I realize this is a CORS problem. Since I cannot change Facebook's behavior, how do I deal with this problem? or fundamentally I do fb server-side login in a wrong way?
ps. my env is AWS + Beego (golang)
You cannot ask for https://www.facebook.com/dialog/oauth?... from JavaScript and wait for its results; that page is intended to be shown in a browser, so that Facebook can ask the user for its credentials and permission to use his account in your app.
So, instead of:
$.get("https://localhost/fblogin", function(data, status) {});
you should use something like:
location = "https://localhost/fblogin";
in your app settings in Facebook in settings tab (somewhere like https://developers.facebook.com/apps/{app-id}/settings/)you should set your site URL to https://localhost/ so it can recognize it as a valid redirect

Facebook API: Post on Facebook wall is not working

I'm a Facebook app developer. I have developed some apps. Everything was working good.
I have not developed any apps for the past 6 months. Now I started to develop an app with existing code. It is not working like what I expected. I don't know why. I have checked the coding with old apps. Everything is fine.
FB.getLoginStatus(function(response) {
if (response.status === 'connected') {
} else {
loginUrl = "https://www.facebook.com/dialog/oauth/?client_id=" + appId + "&redirect_uri=https://apps.facebook.com/appname/&scope=email,user_activities,user_likes,publish_actions,read_stream,publish_stream";
top.location.href = loginUrl;
}
}, true);
I couldn't post on my facebook wall. Error ((#200) The user hasn't authorized the application to perform this action) is coming.
Please advice.
The authorization did not work. Use FB.login for authorization: https://developers.facebook.com/docs/reference/javascript/FB.login/v2.1
Important note: Call it on user interaction, and NOT in the (asynchronous) callback function of FB.getLoginStatus. You should not directly present the authorization screen/popup to the user right when he opens your App/Website anyway.
Also, publish_stream is deprecated, publish_actions is the only permission you need for posting.

How do I log a user out of my FB app but not Facebook site?

I am using Facebook login integration on my asp.net site. What I want is that when a user logs off the site, I want him to also log off the FB application, but not Facebook itself. If I call FB.logout(), it logs off FB as well as the app.
I guess what I want is to lose the acess_token cookie for the app, but I can't figure it out.
FB.api({ method: 'Auth.revokeAuthorization' });
I dont think that is possible as the login for both the application and FB is done using FB credentials..
In case you want to de-authorize the user from your application you can issue an HTTP DELETE request to /PROFILE_ID/permissions to revoke authorization for an app.
I'm not sure this is a good idea. Even if you removed the session for your website, if they are still logged into facebook, they may as well still be logged into your website. They are essentially the same thing. You need to log them out of facebook to ensure their security on your site, otherwise it just takes someone sharing the pc or cookie sniffing, to get access to their account on your site
edit: also, if you just want to delete the cookie, you can simply do this with javascript.