使用严格和GET参数登录Facebook Oauth

Question

I have done some research and got a specific problem with facebook login SDK. I use the PHP SDK. So, as from march 2018 all facebook developers will be seing "Use Strict Mode for Redirect URIs" turned on (and cannot turn it off). My website was working fine before the latesr API update. The basic login logic was this:

Users go to https://my-website.com/take.php?someGetParam=here-goes-the-parameter .
If there is no facebook user logged in, the current user will be redirected to the facebook login dialog, will check the permissions and on success the user will be redirected back to the URL above, and then will be redirected to another page.

As from now, with the newest changes, in order for the login flow with this GET Parameters to work, I have to manually insert them in the "Valid OAuth redirect URIs" field in the facebook developers dashboard of my API like this:

https://my-website.com/take.php?someGetParam=parameter-1
https://my-website.com/take.php?someGetParam=parameter-2
https://my-website.com/take.php?someGetParam=parameter-3
and so on...

otherwise I get the error:The domain of this URL isn't included in the app's domains. To be able to load this URL, add all domains and subdomains of your app to the App Domains field in your app settings.

Is there a way not to include manually this URLs (because there are many) but to insert only one and get the login flow to work. PS: I am trying to insert:
https://my-website.com/take.php
OR
https://my-website.com/take.php?someGetParam=
but no effect

Answer 1

You can add any value that you want in the state parameter. The most frequent usage for this parameter is to prevent CSRF , but you can pass anything you would want to be sent back, even an encoded JSON.

This parameter will be returned to you and is exempted on the strict URL matching.

This is documented in Invoking the Login Dialog and Setting the Redirect URL

state. A string value created by your app to maintain state between the request and callback. This parameter should be used for preventing Cross-site Request Forgery and will be passed back to you, unchanged, in your redirect URI.

Answer 2

I encountered a similar situation, I manged to solve it by setting the Valid " OAuth redirect URIs " as follows:

https://localhost/FacebookLogin/fb-callback.php?client_id=<insert_your_app_id_her>&return_scopes=true

Please note the following

• Insert you facebook app id in the place holder in the sample url above.

• Make sure you use the latest version of the SDK which is 5.6.2