Signed request has no app_data

Question

I have a little Facebook app in development process. The goal is to track user invites and count how many users have registered "under" the users. If the goal number is reached, they will get some gift.

My problem is, that I can't store the Request Ids.

The app works like this:

First, the redirection via JavaScript to the Facebook page with the installed app. The request url is apps.facebook.com/XY this is not good for me, because we want to increase the Facebook page like numbers, so if the app loads it checks the url, and if it's the apps.facebook.com it redirects to the Facebook page. Because it's a javascript redirection I can only save the request ids in the app_data section.

This is the PHP part to get the request ids:

    $request_ids = "";

if(isset($_REQUEST['request_ids'])){

    if (!isset($_SESSION["RI"]))
    {
        $_SESSION["RI"] = $_REQUEST['request_ids'];
    }else{
        $request_ids = $_SESSION["RI"];
    }
}

This is the JavaScript part in the BODY:

        <script type="text/javascript">
    function NotInFacebookFrame() {
         return top === self;
    }
    function ReferrerIsFacebookApp() {
         if(document.referrer) {
        return document.referrer.indexOf("apps.facebook.com") != -1;
        }
        return false;
        }
         if (NotInFacebookFrame() || ReferrerIsFacebookApp()) {
        top.location.replace("<?= $fbPageAppURL.'&app_data='.$request_ids ?>");
        }
        function sendRequestViaMultiFriendSelector() {
            FB.ui({
            method: 'apprequests',
            message: "<?= $friendInviteMessage ?>"
            });
        } 
    </script>

After the redirection the app_data IS set I can see it in the URL, but the signed_request has no app_data set. I store the signed request in session variable, because I have subpages in the app and this way the signed request is always set:

    if (!isset($_SESSION["SR"]))
{
    $_SESSION["SR"] = $_REQUEST["signed_request"];
}else{
    $encoded_sig = null;
    $payload = null;
    list($encoded_sig, $payload) = explode('.', $_SESSION["SR"], 2);
    $sig = base64_decode(strtr($encoded_sig, '-_', '+/'));
    $signed_request = $data = json_decode(base64_decode(strtr($payload, '-_', '+/'), true));
}

$signed_request = objectToArray($signed_request);

So after this the var_dump($signed_request); has NEVER app_data in it :(

Can someone help me out? Thank you very much!

UPDATE: okay, right now I see, that the $signed_request isn't right... If I load the app without the request link, it always redirects me to the "please like the page" section:

    $page_id = $signed_request["page"]["id"];
$like_status = $signed_request["page"]["liked"];

    if(!$like_status){
        header("Location: notfan.php");
        exit;
    }

So the signed request has no app_data and no page and like information... :(

EDIT: this is the full code of the signed request and request ids handling:

    $signed_request = $facebook->getSignedRequest();
$request_ids = "";

if(isset($_REQUEST['request_ids'])){

    if (!isset($_SESSION["RI"]))
    {
        $_SESSION["RI"] = $_REQUEST['request_ids'];
    }else{
        $request_ids = $_SESSION["RI"];
    }
}

if (!isset($_SESSION["SR"]))
{
    $_SESSION["SR"] = $_REQUEST["signed_request"];
}else{
    $encoded_sig = null;
    $payload = null;
    list($encoded_sig, $payload) = explode('.', $_SESSION["SR"], 2);
    $sig = base64_decode(strtr($encoded_sig, '-_', '+/'));
    $signed_request = $data = json_decode(base64_decode(strtr($payload, '-_', '+/'), true));
    $signed_request = objectToArray($signed_request);
}

Answer 1

This is my way of handling app_data:

The signed_request:

$fbsr = $facebook->getSignedRequest();
if ($fbsr['app_data'])
{
    parse_str(base64_decode($fbsr['app_data']), $app_data);
    $_GET = array_merge($_GET, $app_data);
}

And the Link

$app_data = base64_encode(http_build_query(array('key' => 'value')));
$url = 'https://www.facebook.com/pages/' . $page_name . '/' . $page_id . '?sk=app_' . $appId . '&app_data=' . $app_data;

Maybe it helps you.

EDIT

In your code is see this:

top.location.replace("<?= $fbPageAppURL.'&app_data='.$request_ids ?>");

But $request_ids has to be a base64_encoded query string like this:

top.location.replace("<?= $fbPageAppURL.'&app_data='.base64_encode(http_build_query($request_ids)) ?>");

or if $request_ids is a string:

top.location.replace("<?= $fbPageAppURL.'&app_data='.base64_encode(http_build_query(array('request_ids' => $request_ids))) ?>");