OAuth后，Facebook redirect_uri无法识别用户

Question

Facebook's OAuth is boggling my mind... again. We have a fairly straight-forward system:

1. User uses OAuth to 'receive' Facebook permissions (basic user info + extended permission: writing on wall)
2. Via a customized redirect_uri the user is redirected back to our platform where the user information is stored in the database and the user is also flagged 'logged in' using our own login system.

However, the problem is that sometimes (I repeat: sometimes...) the user is not recognized through the $user = $facebook->getUser(); request. Only if $user is set, the user is stored in the database as we only know the user is authenticated and are able to use $facebook->api('/me');

The weird thing is that after first trials users are prompted an error, but if they click 'Login with Facebook' again, everything goes well. And again, not all users experience this problem. I get the feeling my code does not yet 'recognize' the user as logged in when executing all the login/account creation stuff.

Really hope anyone can help, below I've posted the code.

INITIATION:

    $loginUrl = $facebook->getLoginUrl(array('scope' => 'friends_relationships,publish_stream,email,user_birthday,user_location,user_checkins,user_education_history,user_photos','redirect_uri' => 'REDIRECTED_PAGE.php'));

    RETURN PAGE (REDIRECT_PAGE.PHP)

    $fbuser = $facebook->getUser();

    if ($fbuser) {
      try {
        $user_profile = $facebook->api('/me');
      } catch (FacebookApiException $e) {
        error_log($e);
        $fbuser = null;
      }
    }

    $uid = $user_profile['id'];

    // -> here's the problem: $fbuser is either 0 or not set

    if (isset($fbuser) && $fbuser != '0') 
    {
     $dbc = new DBC();
     $dbc->connect(0, true);
     $fbemailquery = $dbc->executeQuery("SELECT * FROM users WHERE fbuid = '".$uid."'");
     if(!$dbc->isResultEmpty($fbemailquery)) { 

      // USER IS KNOWN, SO LOGIN

     }
     else { 

      // NEW USER

      $firstname = $user_profile['first_name']; // etc etc
     }
     $dbc->close();
    }

Answer 1

Facebook applications are tricky indeed. Are you entering the application via your site directly? or are you using an internal facebook application? (like apps.facebook.com/application). I ask you this because facebook has a different mechanism to deal with authentications depending if you are on your own site or directly at facebook.com The first will ask you to get an access code which is embeeded in the $_REQUEST['code'] var which you can later exchange for an access token (with the permissions you are requesting). However if you are accessing via facebook.com there is a signed_request sent via POST to your application canvas url which you have to decode in order to get the access_code that is bundled inside (if the user already authorized your app) or not present (if the user declined your app).