Hi, I've moved to the latest version of the SDK and tried the simple login example for starters and it was working fine a few days ago. However I now get the following error:

Facebook SDK returned an error: Cross-site request forgery validation failed. Required param "state" missing.

I can't figure out the problem, I've had a look at the following section of the Helper.

 /**
 * Validate the request against a cross-site request forgery.
 *
 * @throws FacebookSDKException
 */
protected function validateCsrf()
{
    $state = $this->getState();
    $savedState = $this->persistentDataHandler->get('state');

   if (!$state || !$savedState) {
        throw new FacebookSDKException('Cross-site request forgery validation failed. Required param "state" missing.');
    }

    $savedLen = strlen($savedState);
    $givenLen = strlen($state);

    if ($savedLen !== $givenLen) {
        throw new FacebookSDKException('Cross-site request forgery validation failed. The "state" param from the URL and session do not match.');
    }

    $result = 0;
    for ($i = 0; $i < $savedLen; $i++) {
        $result |= ord($state[$i]) ^ ord($savedState[$i]);
    }

    if ($result !== 0) {
        throw new FacebookSDKException('Cross-site request forgery validation failed. The "state" param from the URL and session do not match.');
    }
}

This will fix #605, it is also related to #586.

This is a PR in order to better support PSR7 in this library by using HTTPlug abstraction. By using HTTPlug a lot of code can be removed and the maintenance will be more focus on the graph API and not the HTTP transport layer (as you can see the diff, a lot of code is no longer necessary).

Advantages

• End user choice: The end user will have the choice of the http client implementation, which will be, for a majority of user, the guzzle6 library. However some others librairies can be chosen, like Zend/Http or CakePHP one which are already available in their respective framework.

  By not couple us to Guzzle6 we allow people to use this SDK with Guzzle5 (or any other adapter).

• Less maintenance on this library: HTTPlug offer a large feature set (with the usage of the client-common package) which does not need to be rewrite in this library: Retry failed requests, Load Balancing (Client Pool), Failure detection, logging, caching etc ...

• Better integration with frameworks (Symfony ATM, Laravel in progress): HTTPlug offer an integration to existing frameworks for library using this layer. In example, for Symfony all requests will be logged and traced when in dev mode (time, memory, diff at each modification, etc ....).

• Shared work: Many libraries already implement HTTPlug or are on the way, this mean, we can better profit for feature offered / wanted by other libraries.

Future work

One could go further with PSR-7. I've chosen to stop here for this PR. But possible future work could be:

• Removing the FacebookResponse and FacebookRequest
• Remove RequestBodyMultipart and replace it with MultipartStreamBuilder
• Remove RequestBodyUrlEncoded and RequestBodyInterface
• Remove FacebookClient::getHttpClient

The official docs demonstrate some sub-classes like GraphUser, and the code have another unmentioned classes like GraphAlbum, and many other types still haven't classes at all.

I just want to ask about your plan to offer a complete set of GraphObject sub-classes? and if you have any plan to support Edges in addition to the Fields?

I'm really interested to contribute in these points, but I need to hear from you before I add any pull requests?

When i am trying to login with facebook on my site, after facebook login it throwing

Graph returned an error : Can't Load URL: The domain of this URL isn't included in the app's domains. To be able to load this URL, add all domains and subdomains of your app to the App Domains field in your app settings.

It was working fine two days ago. Today one of my user told me regarding this and when i checked it is throwing error after facebook login.

What is the problem & how do I fix it? I've searched, and found many similar posts, but none of them have a solution that I can figure out how to apply.

Thanx for help in advance

Hi Guys,

Facebook shipped a Resumable video upload api(https://developers.facebook.com/docs/graph-api/video-uploads) on F8, which will helps video publisher to achieve a more reliable uploading experience. In order to simplify the developer work, we want to add a helper class in php sdk, which will receive the single video file, cut it into small chunks and feed facebook chunked uploading api.

We already add this functionality into Facebook python sdk(https://github.com/facebook/facebook-python-ads-sdk/blob/master/facebookads/video_uploader.py). And currently want to have the same thing in php sdk with our July release.

@YuanhuiChen is working on this new sdk api right now. https://github.com/facebook/facebook-php-sdk-v4/pull/452

@SammyK just kindly noticed me that we didn't kick any discussion for this sdk api interface yet. I'm sorry. It is our mistake. But would like to start the discussion now and keep everyone in the same page.

Could you guys take a look at this diff and give us your insight feedbacks?

Thanks a lot, Lei

Phew! OK, let's see everyone can agree on this setup. :) This isn't 100% 4.1 feature packed but we can use it as a good starting point if everything is OK.

Setup

To make a request to Graph, you need to instantiate a new FacebookApp to hold your app config. You'll also need a FacebookClient to send request entities to Graph.

use Facebook\Entities\FacebookApp;
use Facebook\FacebookClient;

$facebookApp = new FacebookApp('{app-id}', '{app-secret}');
$facebookClient = new FacebookClient(/* $httpClientHandler, $enableBeta */);

Simple GET Request

use Facebook\Entities\FacebookRequest;

$request = new FacebookRequest($facebookApp, '{access-token}', 'GET', '/me'/*, $params, $eTag, $graphVersion */);
$facebookResponse = $facebookClient->sendRequest($request);

$userProfile = $facebookResponse->getGraphObject();

Simple POST Request

use Facebook\Entities\FacebookRequest;

$request = new FacebookRequest($facebookApp, '{access-token}', 'POST', '/me/feed', ['message'=>'Foo message!']/*, $eTag, $graphVersion */);
$facebookResponse = $facebookClient->sendRequest($request);

$data = $facebookResponse->getDecodedBody();

$id = $data['id'];

Simple DELETE Request

use Facebook\Entities\FacebookRequest;

$request = new FacebookRequest($facebookApp, '{access-token}', 'DELETE', '/{some-id}'/*, $params, $eTag, $graphVersion */);
$facebookResponse = $facebookClient->sendRequest($request);

$data = $facebookResponse->getDecodedBody();

$wasSuccessful = $data['was_successful'];

Batch Request Setup

use Facebook\Entities\FacebookBatchRequest;

$batchRequest = new FacebookBatchRequest(/* $facebookApp, '{access-token}', [$requests], $graphVersion */);

Three ways to add requests to batch request

Via constructor

use Facebook\Entities\FacebookBatchRequest;
use Facebook\Entities\FacebookRequest;

// If $facebookApp and $accessToken on a `FacebookRequest` are null, it will fallback to the parent `FacebookBatchRequest` app & token.
$requests = [
  new FacebookRequest(null, null, 'GET', '/me'),
  new FacebookRequest($facebookApp, '{access-token}', 'POST', '/me/feed', ['foo'=>'bar']),
  ];
$batchRequest = new FacebookBatchRequest($facebookApp, '{access-token}', $requests);

Via add() as an array

use Facebook\Entities\FacebookRequest;

// Numeric array:
$requests = [
  new FacebookRequest(null, null, 'GET', '/me'),
  new FacebookRequest($facebookApp, '{access-token}', 'POST', '/me/feed', ['foo'=>'bar']),
  ];
$batchRequest->add($requests);

// ... OR ...

// Associative array:
// The key of the array will be used to assign a name to the request.
$requests = [
  'named-request-one' => new FacebookRequest(null, null, 'GET', '/me'),
  'named-request-two' => new FacebookRequest($facebookApp, '{access-token}', 'POST', '/me/feed', ['foo'=>'bar']),
  ];
$batchRequest->add($requests);

Via add() as a FacebookRequest

$batchRequest->add(new FacebookRequest(null, null, 'GET', '/me'));
$batchRequest->add(new FacebookRequest($facebookApp, {access-token}, 'GET', '/me'), 'my-reqest-name');

Getting a response from batch request

$facebookBatchResponse = $facebookClient->sendBatchRequest($batchRequest);

foreach ($facebookBatchResponse as $response) {
  if (!$response->isError()) {
    // $response is a `FacebookResponse` entity
  } else {
    $e = $response->getThrownException();
    echo $e->getMessage();
  }
}

Helpers

You also pass along the FacebookApp and FacebookClient into the helpers like so:

$app = new FacebookApp('123', 'foo_app_secret');
$helper = new FacebookRedirectLoginHelper($app);

AccessToken

The AccessToken entity requires FacebookApp and FacebookClient for requests that call Graph. For example:

$accessTokenFromCode = AccessToken::getAccessTokenFromCode('foo_code', $app, $client);

I think this could be done better for the future. I'd like to simplify the AccessToken entity to only hold data about the access token. And any calls to graph could be done with a FacebookAccessTokenHelper. What do you guys think?

Simplified FacebookHttpClientInterface

I also simplified the FacebookHttpClientInterface so that the request headers could be sent as an argument in the send() method.

Integration Tests Labled

The tests that actually touch Graph are labeled "integration". So you can run the test suite with:

$ phpunit --exclude-group integration

And it won't touch the live version of Graph. So now we can incorporate Travis CI without any issues! :)

TODO

For the next few PR's:

• Factories to make FacebookRequest's and FacebookBatchRequest's
• Collections on GrahObject
• Adding GraphList with pagination

Hey Guys,

I'm developing my website ---- and I'm having an issue with my Facebook callback page. I'm getting this error: Facebook SDK returned an error: Cross-site request forgery validation failed. The "state" param from the URL and session do not match..

I was reading Facebook PHP SDK and I found that when you call $fb->getRedirectLoginHelper() a new value for $_SESSION["FBRLH_state"] will be assigned so when I call it again on my callback (because I need to get the accessToken) , a error will happen because ($_SESSION["FBRLH_state"] != $_GET['state']);

https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/Helpers/FacebookRedirectLoginHelper.php

public function __construct(OAuth2Client $oAuth2Client, PersistentDataInterface $persistentDataHandler = null, UrlDetectionInterface $urlHandler = null, PseudoRandomStringGeneratorInterface $prsg = null)
    {
        $this->oAuth2Client = $oAuth2Client;
        $this->persistentDataHandler = $persistentDataHandler ?: new FacebookSessionPersistentDataHandler();
        $this->urlDetectionHandler = $urlHandler ?: new FacebookUrlDetectionHandler();
        $this->pseudoRandomStringGenerator = PseudoRandomStringGeneratorFactory::createPseudoRandomStringGenerator($prsg);
    }

Index page:

$fb = $this->facebook;
$helper = $fb->getRedirectLoginHelper();
$permissions = ['email','public_profile','user_friends'];
$loginUrl = $helper->getLoginUrl('https://fleacollege.com/login/facebook', $permissions);

//passing url from controller to view :
$this->view->facebookURL = $loginUrl;

Callback page:

$fb = $this->facebook;
$helper = $fb->getRedirectLoginHelper();

try {
$accessToken = $helper->getAccessToken();
} catch(Facebook\Exceptions\FacebookResponseException $e) {
// When Graph returns an error
echo 'Graph returned an error: ' . $e->getMessage();
exit;
} catch(Facebook\Exceptions\FacebookSDKException $e) {
// When validation fails or other local issues
echo 'Facebook SDK returned an error: ' . $e->getMessage() . "</br>";
exit;
}

$accessToken = $helper->getAccessToken();
echo $_SESSION["FBRLH_state"] . "</br>";
echo $_GET['state'];

return from echo:

e7fca1bfcb37fe3262468c068b72a3de
e0eec1b15428c9429846d2b41753473f

Anyone know why this is happening? I just followed https://developers.facebook.com/docs/php/howto/example_facebook_login/5.0.0

Hi, I'm using the latest version of the sdk (5.5.0) I've unset the appsecret_proof in the app advanced config, but when I use a valid access token got directly from the api tools. But I get all the time the next error:

Invalid appsecret_proof provided in the API argument

This is a code issue, due I'm using the main README.md code that should works but don't. Please, check it and fix it this, so we can not use que facebook until now.

I am trying to use the batch upload to work with photos but I am getting an error.

For some reason it uploads the first photo but the other photos throw an error.

Is there a quick guide to get this to work?

it returns email only for sdk registered user and return null for all users even if i login using email. $response = $fb->get('/me?fields=id,name,first_name,last_name,email,gender,education,birthday,location,picture,link', $accessToken);

but it returns null except my registered account.

You heard it on PHP Roundtable first ladies and gentlemen! Straight from the horse's mouth, @gfosco is open to supporting SemVer! Yay! :D

But! The question is: how?

The current repo is prefixed with -v4. I know we can rename, but GitHub doesn't support 301 redirects which can be problematic for all the links pointing to this repo. But once it's renamed, it should be pretty trivial (I think) to point packagist to the new repo & people can still use composer like they've always done.

Anyone ever done this before & have advice on how we can rename the repo without too much disruption? :) cc @yguedidi @mtdowling

Yay for 5.0! :D

Error in PHP 8.1 Facebook\FacebookApp implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary)

Hi All.

I'm calling $helper->getLogoutUrl($access_token, $redirectUrl); and it doesn't log me out of facebook. I know it's a valid token and the redirect actually works, but my user stays logged-in to facebook no matter what.

Is there something specific beyond the redirect that I need to do? I need to log my user out of facebook so that they can switch to a different facebook user before using my application. I do not use facebook to authenticate in my app.

TIA

I have an app that's pulling business page data (star reviews) working on a testing app, but as soon as I switch to a live app it no longer works.

Can someone confirm this is working.

If APP client use the SDK of Gaming Graph Domain, APP server have to request the URL of Gaming Graph Domain, or add 'GG|' in front APP_ID at Facebook\FacebookApp@getAccessToken. This PR privode a simple way to toggle to use Gaming Graph URL. Reference Gaming Graph Domain (graph.fb.gg)

Dear all. I want to post a video on my Facebook page with the name of the page. What is the correct permeation that I need to have on my app?

Reagrads