Facebook .NET SDK：如何使用ASP.NET MVC 2进行身份验证

Question

I am trying to get the grip on the Facebook SDK and at the same time transitioning from ASP.NET forms to MVC (finally). So please bear with me ..

I have created two controller actions:

FBLogon is execetued when the user clicks on the FB login button on the form. He is then redirected to the FB login page.

Afterwards he gets sent back to the FBAuthorize page, which is supposed to parse the returned url for the access token. I get something like:

http://localhost:5000/account/FBAuthorize#access_token=199143326771791|827213759889396d5408fee6-100001815992604|BmYchAOMqSoZ2L0TYgCrtpoKP3M&expires_in=0

The problem I see, is that as the access_token is passed behind a #, asp.net cannot parse it on the server. Am I doing something fundamentaly wrong?

Code follows:

    public ActionResult FBLogon()
    {
        var settings = ConfigurationManager.GetSection("facebookSettings");
        IFacebookApplication current = null;

        if (settings != null)
        {
            current = settings as IFacebookApplication;
            if (current.AppId == "{app id}" || current.AppSecret == "{app secret}")
            {
                return View();
            }
        }

        string[] extendedPermissions = new[] { "publish_stream", "offline_access" };
        var oauth = new FacebookOAuthClient { ClientId = current.AppId, RedirectUri = new Uri("http://localhost:5000/account/FBAuthorize") };
        var parameters = new Dictionary<string, object>
                {
                    { "response_type", "token" },
                    { "display", "page" }
                };

        if (extendedPermissions != null && extendedPermissions.Length > 0)
        {
            var scope = new StringBuilder();
            scope.Append(string.Join(",", extendedPermissions));
            parameters["scope"] = scope.ToString();
        }


        var loginUrl = oauth.GetLoginUrl(parameters);
        return  Redirect(loginUrl.ToString());
    }


    public ActionResult FBAuthorize()
    {

        FacebookOAuthResult result;
        if (FacebookOAuthResult.TryParse(Request.Url, out result))
        {
            if (result.IsSuccess)
            {
                var accesstoken = result.AccessToken;
            }
            else
            {
                var errorDescription = result.ErrorDescription;
                var errorReason = result.ErrorReason;
            }
        }
        return View();
    }

Answer 1

Ok. The facebook docs say it quite clearly:

Because the access token is passed in an URI fragment, only client-side code (such as JavaScript executing in the browser or desktop code hosting a web control) can retrieve the token. App authentication is handled by verifying that the redirect_uri is in the same domain as the Site URL configured in the Developer App

from http://developers.facebook.com/docs/authentication/ ---> Client-side Flow Section.

So I'm sending the token back to my server to complete the authentication..

Update:

The sending back to the server I do using Javascript something like this:

               var appId = "<%: Facebook.FacebookContext.Current.AppId %>";

                if (window.location.hash.length > 0) {
                    accessToken = window.location.hash.substring(1);
                    var url = window.location.href.replace(/#/, '?');
                    window.location = url;
}

On the server then I have the following action. Not very nice but it works..

public ActionResult FBAuthorize()
{

    FacebookOAuthResult result  = null;


    string url = Request.Url.OriginalString;
    /// hack to make FacebookOuthResult accept the token..
    url = url.Replace("FBAuthorize?", "FBAuthorize#");

    if (FacebookOAuthResult.TryParse(url, out result))
    {
        if (result.IsSuccess)
        {

            string[] extendedPermissions = new[] { "user_about_me", "offline_access" };

            var fb = new FacebookClient(result.AccessToken);

            dynamic resultGet = fb.Get("/me");
            var name = resultGet.name;

            RegisterModel rm = new Models.RegisterModel();
            rm.UserName = name;
            rm.Password = "something";
            rm.Email = "somethig";
            rm.ConfirmPassword = "23213";
            //Label1.Text = name;

            //Response.Write(name);
            //return RedirectToAction("register", "Account", rm);
            ViewData["Register"] = rm;
            return RedirectToAction("Register");

        }
        else
        {
            var errorDescription = result.ErrorDescription;
            var errorReason = result.ErrorReason;
        }
    }
    return View();
}

Answer 2

I am in the same spot you are at the moment. We never get the Request.QueryString populated becasue of the "fragment" or # in the url.

Love to know if you solved this and how.

It does not look like the FacebookOAuthResult class was written to be used in web applications of any sort.

you can change the response type in you scope paramas to be "code" then it will send back a code in the querystring in which you can swap for a token.

Answer 3

I found this post http://facebooksdk.codeplex.com/discussions/244568 on codeplex. I think this is what you need.

Note that instead of using the client-side flow, you need to use the server-side flow.

This is what you should do

Create a login link for server-side flow. After Authorization, facebook will return an url containing a code instead of a access token.

Then you request for a token from facebook using the code. this is my example

    public ActionResult FBAuthorize()
    {
        FacebookOAuthClient cl = new FacebookOAuthClient(FacebookContext.Current);
        FacebookOAuthResult result = null; 
        string url = Request.Url.OriginalString;

        // verify that there is a code in the url
        if (FacebookOAuthResult.TryParse(url, out result))
        {
            if (result.IsSuccess)
            {                                       
                string code = result.Code;

                // this line is necessary till they fix a bug *see details below
                cl.RedirectUri = new UriBuilder("http://localhost:5000/account/FBAuthorize").Uri;

                var parameters = new Dictionary<string, object>();

                //parameters.Add("permissions", "offline_access");

                Dictionary<String, Object> dict = (Dictionary<String, Object>)cl.ExchangeCodeForAccessToken(code, new Dictionary<string, object> { { "redirect_uri", "http://localhost:5000/account/FBAuthorize" } });


                Object Token = dict.Values.ElementAt(0);

                TempData["accessToken"] = Token.ToString();

                return RedirectToAction ("ShowUser");
            }
            else
            {
                var errorDescription = result.ErrorDescription;
            }
        }
        else 
        {
            // TODO: handle error
        }             
        return View();
    }

*There is bug when using IIS in localhost, see the original post for details (the redirect uri when asking for the token must be the same as the one used asking for the code)

It is highly recommended to use IIS and not visual studio web server. There are many things that wont work in visual studio web server.