facebook php sdk - 如果用户没有授予权限，则会捕获（身份验证失败）

Question

Documentation says: "redirect_uri - (optional) The URL to redirect the user to once the login/authorization process is complete. The user will be redirected to the URL on both login success and failure, so you must check the error parameters in the URL as described in the authentication documentation. If this property is not specified, the user will be redirected to the current URL (ie the URL of the page where this method was called, typically the current URL in the user's browser)." So there is a method to catch if user refused autnentication/permissions, but link to corresponding documentation doesnt exist anymore ( https://developers.facebook.com/docs/authentication/ ).

For the simplicity, redirect_uri is same address as a starting php file, and the php code is as simple as:

require 'facebook.php';
$facebook = new Facebook(array(
  'appId'  => 'X',
  'secret' => 'Y',
));
$user = $facebook->getUser();
if ($user) {
  try {
    $user_profile = $facebook->api('/me');
  } catch (FacebookApiException $e) {
    error_log($e);
    $user = null;
  }
}
if (!$user) {
  $params = array(
    'scope' => 'read_stream, friends_likes',
    'redirect_uri' => 'http://myapp.com/app'
  );
  $loginUrl = $facebook->getLoginUrl($params);
}

Anybody knows how to catch that information?

Answer 1

You can do following to check the permissions:

$permissions = $facebook->api("/me/permissions");
if( array_key_exists('publish_stream', $permissions['data'][0]) ) {
    // Permission is granted!
    // Do the related task
    $post_id = $facebook->api('/me/feed', 'post', array('message'=>'Hello World!'));
} else {
    // We don't have the permission
    // Alert the user or ask for the permission!
    header( "Location: " . $facebook->getLoginUrl(array("scope" => "publish_stream")) );
}

Answer 2

It should be noted that in the newest PHP facebook SDK, there is no method ->api. There also seems to be an issue using this check (sometimes) to get permissions. When using the older SDK, sometimes (randomly by user it seemed) some users were getting "OAuthException: (#412) User has not installed the application" even though a check on the FB access token debugger showed proper permissions. After I updated to new SDK, and figured out the new way to get a simple data list of permissions, everything worked again.

It took me a lot of digging in the FB website to find this solution, so I paste it here to hopefully save somebody else a few hours. They real life saver was my discovery of the getDecodedBody method (a very hard to find trick in FB docs). My example just checks for publish_actions.

$fb = new Facebook\Facebook([
    'app_id' => your_app_id,
    'app_secret' => your_secret,
    'default_graph_version' => 'v2.2',
 ]);

$badperms=true; //start by assume bad permissions

try {
    $response = $fb->get('/me/permissions', $at);
    $perms = $response->getDecodedBody();

    if($badperms){
        foreach($perms['data'] AS $perm){
            if($perm['permission']=='publish_actions' && $perm['status']=='granted') $badperms=false;
        }
    }

} catch(Facebook\Exceptions\FacebookResponseException $e) {
    log("MSG-received facebook Response exception!! ".$e->getMessage());
} catch(Facebook\Exceptions\FacebookSDKException $e) {
    log("MSG-received facebook SDK exception!! ".$e->getMessage());
}

if($badperms) {
    //do something like reflow auth
}

Answer 3

I just had the same issue, I didn't know how to treat the cancel action (both in facebook php api and google oauth2).

The solution is much easier than expected.

The response in case of permission not accepted (at all) comes with at least one parameter/variable: error in the URL.

In facebook that response looks like:

error=access_denied&error_code=200&error_description=Permissions+error&error_reason=user_denied

for google you only get the

error=access_denied

but it should be enough.

I'm just checking if error is set and if it's set I am redirecting the response to my login page.

I hope it will help someone because it's really not documented this step. By the way: version of facebook API: v5 version of google API oAuth2: 2.0 (i think - google doc is really a mess when it comes to finding the latest versions)