在FB.com上移除应用后，FB应用无法从iOS请求权限

Question

We found an odd set of circumstances that can cause an error when sharing to Facebook from our iOS application. I'm trying to figure out if it might just be a bug in the way Facebook responds to this set of events or maybe there's a way to avoid it.

Basically, our iOS app does not re-ask for permissions after a user has revoked permissions from the FB website. We expected our app would re-ask but instead it attempts to share content and then fails with a generic error message. There's no opportunity for the user to grant permission again.

The exact set of circumstances:

1. User wants to share content from iOS app, the FB app connected to it asks for permissions, and everything works.
2. User removes app from their profile with FB.com app settings.
3. User shares content from iOS app again, and the FB app submits but then returns an error rather than re-ask for permissions.

Jeremy

Answer 1

The testers figured out they weren't giving the app enough time to clear its cache on the device so there was a mismatch between permissions on the device and permissions on Facebook.

Previously, they would remove permissions at FB.com and then immediately try to share from the iOS app. Now, they're reporting that if they wait an hour the app will re-request permissions normally.

Thanks!

Answer 2

I don't know what causes your problem, but I might have a work around for you: Set a deauthorize callback url in the advanced app settings. This way you can catch every user who deauthorizes your app and save it to your data base or whatever. The url might link to a php file which looks like the following:

<?php

$secretKey = "APP_SECRET_KEY";
$data = parse_signed_request($_REQUEST['signed_request'], $secretKey);
$fbUserId = $data['user_id'];
// do with the user id whatever you want

function parse_signed_request($signed_request, $secret) {
    list($encoded_sig, $payload) = explode('.', $signed_request, 2);

    // decode the data
    $sig = base64_url_decode($encoded_sig);
    $data = json_decode(base64_url_decode($payload), true);

    if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') {
        error_log('Unknown algorithm. Expected HMAC-SHA256');
        return null;
    }

    // check sig
    $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
    if ($sig !== $expected_sig) {
        error_log('Bad Signed JSON signature!');
        return null;
    }

    return $data;
}

function base64_url_decode($input) {
    return base64_decode(strtr($input, '-_', '+/'));
}

?>