Facebook data deletion callback gives “Unable to confirm request was received”

Question

I just convert PHP sample code to C#. This is my endpoint:

   public async Task<IHttpActionResult> Delete([FromBody] FbModel fbModel)
    {
        var res = fbModel.signed_request.Split(new char[] { '.' }, 2);
        var secret = "ababababababababababababa";
        if (res.Length > 1)
        {
            var sig = res[0];
            var json = base64decode(res[1]);
            var data = Newtonsoft.Json.JsonConvert.DeserializeObject<FacebookDeletionDto>(json);

            if (string.IsNullOrEmpty(data.algorithm) || data.algorithm.ToUpper() != "HMAC-SHA256")
                throw new Exception("Unknown algorithm:" + data.algorithm + ". Expected HMAC-SHA256");

            var expected_sig = hmacSHA256(res[1], secret);

            if (expected_sig != sig)
                throw new Exception("Invalid signature:" + sig + ".  Expected" + expected_sig);     

            var returnJson = new { Url = $"https://myperfectsite.com/fb/info/{data.user_id}", confirmation_code = $"{data.user_id}" };

            return Ok(returnJson);
        }
        return null;
    }

This code running perfectly and gives me json. My endpoint return URL and confirmation code in JSON. But in facebook confirmation page it gives me this error:"Unable to confirm request was received "App name" sent an invalid response to your request. Contact "App name" directly to request it delete info it has about you."

Answer 1

Facebook provides only the following info:

Return a JSON response that contains a URL where the user can check the status 
of their deletion request and an alphanumeric confirmation code. 
The JSON response has the following form:

{ url: '<url>', confirmation_code: '<code>' }

I ran into the same problem where FB would not accept our server response. We ultimately fixed the problem by outputting the JSON response in EXACTLY the same sample format. Property names lowercase and not quoted, single quotes around the values, and a value that was alphanumeric (no symbols) and not too long (20 char length worked).

Answer 2

I notice that while in facebook documentation "expected_sig" must be equal to "sig" which must be the result of base64_url decoding of $encoded_sig in your code "expected_sig" is compared to the sign not decoded. Hope this could be helpful.

var sig = res[0];
var json = base64decode(res[1]);
...
if (expected_sig != sig)
     throw new Exception(...)

Correct should be as follow:

var sig = base64decode(res[0]);
var json = base64decode(res[1]);
...
if (expected_sig != sig)
     throw new Exception(...)

Answer 3

Instead of: Delete([FromBody] FbModel fbModel) I use: string signed_request = Request.Form["signed_request"];

Here is my working code:

public async Task<IActionResult> Delete()
{
    string signed_request = Request.Form["signed_request"];
   
    if (!String.IsNullOrEmpty(signed_request))
    {
        string[] split = signed_request.Split('.');

        string signatureRaw = base64decode(split[0]);
        string dataRaw = base64decode(split[1]);

        // the decoded signature
        byte[] signature = Convert.FromBase64String(signatureRaw);

        byte[] dataBuffer = Convert.FromBase64String(dataRaw);

        // JSON object
        var json = Encoding.UTF8.GetString(dataBuffer);

        byte[] appSecretBytes = Encoding.UTF8.GetBytes("SecretKey");
        System.Security.Cryptography.HMAC hmac = new System.Security.Cryptography.HMACSHA256(appSecretBytes);
        byte[] expectedHash = hmac.ComputeHash(Encoding.UTF8.GetBytes(split[1]));
        if (!expectedHash.SequenceEqual(signature))
        {
            throw new Exception("Invalid signature");     
        }
        var fbUser = JsonConvert.DeserializeObject<FacebookUserDTO>(json);
         return Ok(new { url = $"https://myperfectsite.com/fb/info/{fbUser.user_id}", confirmation_code = $"{fbUser.user_id}" });
    }
}