如何强制Facebook在标签网址中使用https

Question

My server use only https with an htaccess redirect at root level, when my tab app is called from a FB page if the user use an http connection I lost the signed request. Everyone knows a solution? How to force Facebook to use https when call a tab? thanks luc

Answer 1

How to force Facebook to use https when call a tab?

In theory, HTTP status codes 307 (Temporary Redirect) and 308 (Permanent Redirect) should be used for this, since they require the method to stay the same, so the client would have to fetch the resource that's been redirected to using POST with the same data again.

However, I have no experience how well this works with the browsers that are out there.

Probably better to “redirect” client-side, using JavaScript. Of course, that requires a resource that is available using HTTP only, and is not redirected server-side to it's HTTPS counterpart.

---

In the future, this “problem” will go away on it's own, I assume – since Facebook announced end of last year that they will move all users to HTTPS; so I think some time from now we won't be required to give a HTTP URL for canvas/page tab apps any more, and use just one HTTPS version.

Answer 2

I resolved in this way:

In the FBapp manager I used as http url a page created on a different server that accept http. In this page I used the following code .

 $signed_request = $facebook->getSignedRequest();
 $page_id   = $signed_request["page"]["id"];
 $fql_query_url = "https://graph.facebook.com"
    ."/$page_id?fields=link"
."";
try {
    $fql_query_result = @file_get_contents($fql_query_url);
    $fql_query_obj = json_decode($fql_query_result, true);
} catch(Exception $o){   }
 $pageinfo = $fql_query_obj[link];
 $pageinfo = str_replace("http://","https://",$pageinfo);
 $tabpage = "$pageinfo"."?sk=app_$appId";
 echo "
 <!-- force tab iframe -->
 <script type=\"text/javascript\">
  top.location.replace('$tabpage');
 </script>
";
 ?>

that's all