Login with Facebook C#

Question

I have an infinty loop of refresh when I try to log in with facebook on my site ,
I have declared a script afer the the body tag that was

           <script>
                window.fbAsyncInit = function () {
                    FB.init({
                        appId: '337323336385***', // App ID
                        status: true, // check login status
                        cookie: true, // enable cookies to allow the server to access the session
                        xfbml: true  // parse XFBML
                    });

                    // Additional initialization code here
                    FB.Event.subscribe('auth.authResponseChange', function (response) {
                        if (response.status === 'connected') {
                            // the user is logged in and has authenticated your
                            // app, and response.authResponse supplies
                            // the user's ID, a valid access token, a signed
                            // request, and the time the access token 
                            // and signed request each expire
                            var uid = response.authResponse.userID;
                            var accessToken = response.authResponse.accessToken;

                            // TODO: Handle the access token
                            //alert("check");
                            // Do a post to the server to finish the logon
                            // This is a form post since we don't want to use AJAX
                            var form = document.createElement("form");
                            form.setAttribute("method", 'post');
                            form.setAttribute("action", '/FacebookLogin.ashx');

                            var field = document.createElement("input");
                            field.setAttribute("type", "hidden");
                            field.setAttribute("name", 'accessToken');
                            field.setAttribute("value", accessToken);
                            form.appendChild(field);

                            document.body.appendChild(form);
                            form.submit();
                        } else if (response.status === 'not_authorized') {
                            // the user is logged in to Facebook, 
                            // but has not authenticated your app
                            //alert("Please ");
                        } else {
                            // the user isn't logged in to Facebook.
                            //alert("jj");
                            alert("Please Sign into your account to access the site");
                        }
                    });
                };

                // Load the SDK Asynchronously
                (function (d) {
                    var js, id = 'facebook-jssdk', ref = d.getElementsByTagName('script')[0];
                    if (d.getElementById(id)) { return; }
                    js = d.createElement('script'); js.id = id; js.async = true;
                    js.src = "//connect.facebook.net/en_US/all.js";
                    ref.parentNode.insertBefore(js, ref);
                }(document));
            </script>

as you see this function it's calling a C# function that's in the file of FacebookLogin.ashx this function is responsable for creating a Session variable containing the data for the user

 public void ProcessRequest(HttpContext context)
 {

  var accessToken = context.Request["accessToken"];
  context.Session["AccessToken"] = accessToken;

  HttpCookie cookie = new HttpCookie("FB");

  string accessToken2 = context.Session["AccessToken"].ToString();
  Facebook.FacebookClient client = new Facebook.FacebookClient(accessToken2);
  dynamic result = client.Get("me", new { fields = "name,id,link,gender" });

  cookie["FBID"] = result.id;
  context.Response.Cookies.Add(cookie);

  context.Response.Redirect("/login.aspx");
}

after that in the pageload I check for the existance of this session variable

                string accessToken;
                FacebookClient client;
                dynamic result;
                if (Session["AccessToken"] != null)
                {
                    accessToken = Session["AccessToken"].ToString();
                    client = new FacebookClient(accessToken);
                    result = client.Get("me", new { fields = "name,id,link,gender" });

                    if (gb.CheckExistanceByFBID(result.id))
                    {
                        string FBID = result.id;
                        var userDetails = context.Users.Where(x => x.FBID == FBID).Select(x => x).First();

                        HttpCookie cookie = new HttpCookie("userData", userDetails.UserName);
                        cookie.Expires = DateTime.Now.AddMonths(2);

                        cookie["UserName"] = userDetails.UserName;
                        cookie["UserID"] = userDetails.UserID.ToString();
                        cookie["Password"] = userDetails.Password;
                        cookie["isAdmin"] = userDetails.Admin.ToString();
                        cookie["Name"] = userDetails.DisplayName;
                        cookie["FBID"] = userDetails.FBID;
                        Response.Cookies.Add(cookie);
                        System.Web.Security.FormsAuthentication.SetAuthCookie(userDetails.UserName, true);
                        System.Web.Security.FormsAuthentication.Timeout.Add(new TimeSpan(40, 0, 0, 0));
                        Response.Redirect("/Default.aspx");
                    }
                    else
                    {
                        //var accessToken = Session["AccessToken"].ToString();
                        //var client = new FacebookClient(accessToken);
                        //dynamic result = client.Get("me", new { fields = "name,id,link,gender" });

                        accessToken = Session["AccessToken"].ToString();
                        client = new FacebookClient(accessToken);
                        result = client.Get("me", new { fields = "name,id,link,gender" });

                        FBRegisterPanel.Visible = false;
                        MainRegisterPanel.Visible = true;
                        txtUserName.Text = result.name;
                    }
                }

the problem that I have an infinty loop of refresh after I click the facebook login button !

Answer 1

I had the same problem.

When login.aspx loads, the JS is executed, which posts the form to FacebookLogin.ashx, which redirects to login.aspx, which means the JS is run again and the cycle continues.

(Hopefully) by doing the following, if an OAuth token is stored, the if-statement is made false so the script to submit the form to FacebookLogin.ashx is never executed.

FB.Event.subscribe('auth.authResponseChange', function (response) {
    if (response.status === 'connected' && "<%= Session["AccessToken"].ToString() %>" == "") { ... }

Note: make sure that Session["AccessToken"] contains an empty string even if there is no access token to store, because:

• the JS is looking for an empty string in Session["AccessToken"] to make the if-statement true.
• if left null, I think <%= Session["AccessToken"].ToString() %> will throw a null reference exception.

You can do this by execuing this on Page_Init:

if (Session["AccessToken"] == null)
{
   Session["AccessToken"] = string.Empty;
}