facebook error 'Error validating verification code' - php
very strange error. i use gide http://developers.facebook.com/docs/authentication/. so i create request to fb and pass redirect_uri. i use test site on localhost. so if i pass
redirect_uri=http://localhost/test_blog/index.php
it works fine, but if i pass
redirect_uri=http://localhost/test_blog/index.php?r=site/oauth2
it don't want work. i try to use
redirect_uri= .
urlencode('http://localhost/test_blog/index.php?r=site/oauth2)
but not work.
i try to explaine. i success get code, but when i access https://graph.facebook.com/me?access_token i get error 'Error validating verification code'. i checked evering, error is in ?r=site/oauth2 but i need passing some params
can somebody help me?
i read post http://forum.developers.facebook.net/viewtopic.php?id=70855 but nothing work for me
There are presently (as of March 2011) undocumented requirements regarding what makes a valid redirect_uri.
First, both redirect_uri paramaters to authorize and access_token must match.
Apparently Facebook (or rather OAuth2) is using the redirect_uri as a internal key to encode the code returned for the access_token request. It's kinda clever since it verifies back to your site. It explains why the access_token request which wouldn't otherwise need a redirect_uri parameter requires one.
Second, you cannot use many special characters in the redirect_uri.
A lot of discussion rages whether parameters can be passed at all. They can, you're limited which characters are valid but no one has published a list that I know. Traditional methods like url/html encoding will fail because percent(%) is not valid. Slash (/) is not valid either so a nested redirection url will always fail. The ONLY way to overcome the special char limitation is to encode the value of the parameter to base64. If you're using ASP.NET, look up Convert.ToBase64.
Lastly, and this is more of a side-note. There are a lot of programmers passing along misinformation that a simple solution is to pass type=client_cred. This may limit your access to some of the permissions you requested in your authorization. It is inadvisable.
Had the same problem all day when testing with redirect_uri=http://localhost:8000 (encoded to http%3A%2F%2Flocalhost%3A8000)...
Solution was simply to make sure to put the trailing slash / on the end of the uri. So redirect_uri=http://localhost:8000/ (encoded to http%3A%2F%2Flocalhost%3A8000%2F).
Again, make sure the redirect_uri is identical for both requests.
I have had this problem. I knew for a fact that my URLs were the same because I used a class with the same $var, but I kept getting the 400 response and that error in the JSON response.
The only thing I did was change my redirect_uri from:
http://myredirecturi.com
to
http://myredirecturi.com/
Yeh, just added the trailing slash and it worked.
You don't really need to encode, just put the '/' at the end of your redirect_url and everything should be fine!
Part of the information given by Aaron Wheeler is incorrect.
It is true that the 'redirect_uri' parameter must be identical in both requests, however it is perfectly possible to URL encode a regular URL and use that as the value for the 'redirect_url' parameter, so long as you're careful to further URL encode any inline URLs.
For instance, you wish facebook to redirect to the following URL:
http://www.mysite.com/Users/oAuthComplete?my_param_1=/Party/pants
Attempting to redirect the user to
'https://www.facebook.com/dialog/oauth?client_id=12345&redirect_uri='
. urlencode('http://www.mysite.com/Users/oAuthComplete?my_param_1=/Party/pants');
Will fail as /Party/Pants creates an invalid URL
However, redirecting to
'https://www.facebook.com/dialog/oauth?client_id=12345&redirect_uri='
.urlencode('http://www.mysite.com/Users/oAuthComplete?my_param_1='
.urlencode('/Party/pants'));
Will work as expected.
If you are using the returned the redrect_uri value in the second, authenticate application request, be sure to url encode again - the value is automatically URL decoded when populating the $_GET superglobal. - This is what tripped me up.
'https://graph.facebook.com/oauth/access_token?client_id=12345&&client_secret=SECRET&code=1234567'
.urlencode('http://www.mysite.com/Users/oAuthComplete?my_param_1='
.urlencode($_GET['my_param_1']));
P.s. In your actual code, I'd recommend using sprintf() rather than chaining string together like in my example, for better readability.
From what I can see, the problem here is that the redirect_uri must end with '/' and not contain '?' or other special characters. I think that is why you are getting 'Error validating verification code'. This error only appears if you are using file_get_contents(), and not when using the facebook php library.
This is the solution for php, don't know if this error appears in other SDK's.
I'm not sure if it will help, but i would suggest to encode only values in the url. Not the whole thing. eg:
redirect_uri='http://localhost/test_blog/index.php?r='.urlencode('site/oauth2');
I was having the pb and finally fix it adding the type=client_cred parameter in the url.
Struggled with this for a while. Since I didn't want a redirect, but the redirect parameter is required, my solution was to simply set it to nothing -
...&redirect_uri=&client_secret=...
I just had the same problem.
Admittedly, I am a super n00b so excuse me if this solution doesnt make any sense in actual practice.
I simply set a short fuse cookie (1-2 min) with a test variable in the page with my FB Connect button. When FB came back with information to my data parsing/handling script I checked for this cookie where I was redirecting it and if found, directed the user to the proper URL using header:location.
Of course some browsers/users etc disable cookies. This obviously wont work there (maybe use a session var and destroy it in the fb data handler?) I am sure there is a better way to do it but at the moment, this bandaid works.
The answer for me was this:
$user = $facebook->getUser();
if (!$user) {
$loginUrl = $facebook->getLoginUrl(array(
'scope' => '',
'redirect_uri' => $this->domain,
));
print('<script> top.location.href=\'' . $loginUrl . '\'</script>');
}
I've been cracking my head a long time before I found this solution, seeming I am not the only one with this issue I hope this works for you to!
I noticed you are using Yii which I'm using as well and had the same problem for half the day. As mentioned, the problem is the special characters in your URL i.e. r=site/oath2
You can fix it by enabling pretty URLS in your config so that your URL becomes index.php/site/oath2
It seems to work without the trailing slash though.
Related
Unable to get query parameters from laravel url get request
this is my url and i am unable to get the query parameters i dont know why. anyone can tell me whats going on? http://localhost:8000/senders/verify#/activate?user=qaisar72477247#email.com&option=AccountActivated if I use http://localhost:8000/senders/verify?user=qaisar72477247#email.com&option=AccountActivated I can successfully get the varaibles but after putting #/activate i can't. i dont know why.
Because paths are not the same. So your route file cannot run from same line. for this http://localhost:8000/senders/verify#/activate?user=qaisar72477247#email.com&option=AccountActivated First part => senders Second part => verify# Third part => activate And these are the params => user=qaisar72477247#email.com&option=AccountActivated For this one: http://localhost:8000/senders/verify? user=qaisar72477247#email.com&option=AccountActivated First part => senders Second part => verify Params => user=qaisar72477247#email.com&option=AccountActivated didnt have the third part.
The issue is the order of the URL. The # is an anchor or fragment component, and is the last part of the URL. The query string should come before the fragment component, as anything after that will be ignored. scheme:[//authority]path[?query][#fragment] src: https://en.wikipedia.org/wiki/URL#Syntax I'm guessing you're using some sort of framework such as Vue, Angular, or React, which means anything after the # is actually handled by that, and is not passed to Laravel. You'll need to manage the request with whichever framework you're using.
If you want to get the value after the hash mark (#) as shown in a user's browser: This isn't possible with "standard" HTTP as this value is never sent to the server (hence it won't be available in $_SERVER["REQUEST_URI"] or similar predefined variables). You would need some sort of JavaScript magic on the client side, e.g. to include this value as a POST parameter. So when you call : localhost:8000/senders/verify#/activate?user=qaisar72477247#email.com&option=AccountActivated Your server get this : localhost:8000/senders/verify The browser delete everything from the hash (#) of your url, then it pass to the server http process
How to access url after # in php
I am trying to pass some parameters after # in the url like http://developer.rohitkhatri.com/test.php#embed=sdkhfjshdkfhhjk, But I don't know how to access it, I tried many solution from the stackoverflow, here are some examples what I've tried: $_SERVER['REQUEST_URI'] gives me /test.php $_SERVER['QUERY_STRING'] gives empty string $_SERVER['HTTP_REFERER'] gives empty string also tried printing the whole $_SERVER array but I did not find anything useful. Any help is appreciated.
Well, there's no way to achieve this, because the part you are trying to access using the php, never goes to the server, what you can do is, just grab the part using the javascript and send it the the server. Like there can be a middle page, which will redirect to the final url, and while redirecting, It can grab the part after # and send it using ajax.
The browser doesn't send anything that comes after the hash(#) to the server because it is resolved within the browser. You can try by mentioned code. $hash = '<script>document.write(document.location.hash)</script>'; echo $hash; output : //#embed=sdkhfjshdkfhhjk
file_get_contents against symfony2
I have a file_get_contents($myUrl) call from a flat PHP script that isn't working. If I run $myUrl in a browser it works fine, if I do it over the file_get_contents() it behaves as if the url is incorrect or incomplete. The myUrl looks like this https://login.myApp.com/getWifiSettings/ofBoSf593f Where the last part is a token, and the sym2 webApp behaves as if that token is incorrect, the same way as if I were to paste everything but the last character in the browser (thus producing an incorrect token). I don't know whether this is an issue caused by the file_get_contents() (do I need any parameters with it to work?) or if it is some security setting in my sym2 installation that denies access for such a call (how does it distinguish between a user's web browser calling the route and a script using file_get_contents to access the route?)
Try to us trim() on the string before you submit it to file_get_contents. It may be that a whitespace character is in the variable and is being submitted and interpreted as part of the URL.
Login with facebook php sdk [duplicate]
very strange error. i use gide http://developers.facebook.com/docs/authentication/. so i create request to fb and pass redirect_uri. i use test site on localhost. so if i pass
redirect_uri=http://localhost/test_blog/index.php
it works fine, but if i pass
redirect_uri=http://localhost/test_blog/index.php?r=site/oauth2
it don't want work. i try to use
redirect_uri= .
urlencode('http://localhost/test_blog/index.php?r=site/oauth2)
but not work.
i try to explaine. i success get code, but when i access https://graph.facebook.com/me?access_token i get error 'Error validating verification code'. i checked evering, error is in ?r=site/oauth2 but i need passing some params
can somebody help me?
i read post http://forum.developers.facebook.net/viewtopic.php?id=70855 but nothing work for me
There are presently (as of March 2011) undocumented requirements regarding what makes a valid redirect_uri. First, both redirect_uri paramaters to authorize and access_token must match. Apparently Facebook (or rather OAuth2) is using the redirect_uri as a internal key to encode the code returned for the access_token request. It's kinda clever since it verifies back to your site. It explains why the access_token request which wouldn't otherwise need a redirect_uri parameter requires one. Second, you cannot use many special characters in the redirect_uri. A lot of discussion rages whether parameters can be passed at all. They can, you're limited which characters are valid but no one has published a list that I know. Traditional methods like url/html encoding will fail because percent(%) is not valid. Slash (/) is not valid either so a nested redirection url will always fail. The ONLY way to overcome the special char limitation is to encode the value of the parameter to base64. If you're using ASP.NET, look up Convert.ToBase64. Lastly, and this is more of a side-note. There are a lot of programmers passing along misinformation that a simple solution is to pass type=client_cred. This may limit your access to some of the permissions you requested in your authorization. It is inadvisable.
Had the same problem all day when testing with redirect_uri=http://localhost:8000 (encoded to http%3A%2F%2Flocalhost%3A8000)... Solution was simply to make sure to put the trailing slash / on the end of the uri. So redirect_uri=http://localhost:8000/ (encoded to http%3A%2F%2Flocalhost%3A8000%2F). Again, make sure the redirect_uri is identical for both requests.
I have had this problem. I knew for a fact that my URLs were the same because I used a class with the same $var, but I kept getting the 400 response and that error in the JSON response. The only thing I did was change my redirect_uri from: http://myredirecturi.com to http://myredirecturi.com/ Yeh, just added the trailing slash and it worked.
You don't really need to encode, just put the '/' at the end of your redirect_url and everything should be fine!
Part of the information given by Aaron Wheeler is incorrect.
It is true that the 'redirect_uri' parameter must be identical in both requests, however it is perfectly possible to URL encode a regular URL and use that as the value for the 'redirect_url' parameter, so long as you're careful to further URL encode any inline URLs.
For instance, you wish facebook to redirect to the following URL:
http://www.mysite.com/Users/oAuthComplete?my_param_1=/Party/pants
Attempting to redirect the user to
'https://www.facebook.com/dialog/oauth?client_id=12345&redirect_uri='
. urlencode('http://www.mysite.com/Users/oAuthComplete?my_param_1=/Party/pants');
Will fail as /Party/Pants creates an invalid URL
However, redirecting to
'https://www.facebook.com/dialog/oauth?client_id=12345&redirect_uri='
.urlencode('http://www.mysite.com/Users/oAuthComplete?my_param_1='
.urlencode('/Party/pants'));
Will work as expected.
If you are using the returned the redrect_uri value in the second, authenticate application request, be sure to url encode again - the value is automatically URL decoded when populating the $_GET superglobal. - This is what tripped me up.
'https://graph.facebook.com/oauth/access_token?client_id=12345&&client_secret=SECRET&code=1234567'
.urlencode('http://www.mysite.com/Users/oAuthComplete?my_param_1='
.urlencode($_GET['my_param_1']));
P.s. In your actual code, I'd recommend using sprintf() rather than chaining string together like in my example, for better readability.
From what I can see, the problem here is that the redirect_uri must end with '/' and not contain '?' or other special characters. I think that is why you are getting 'Error validating verification code'. This error only appears if you are using file_get_contents(), and not when using the facebook php library. This is the solution for php, don't know if this error appears in other SDK's.
I'm not sure if it will help, but i would suggest to encode only values in the url. Not the whole thing. eg:
redirect_uri='http://localhost/test_blog/index.php?r='.urlencode('site/oauth2');
I was having the pb and finally fix it adding the type=client_cred parameter in the url.
Struggled with this for a while. Since I didn't want a redirect, but the redirect parameter is required, my solution was to simply set it to nothing - ...&redirect_uri=&client_secret=...
I just had the same problem. Admittedly, I am a super n00b so excuse me if this solution doesnt make any sense in actual practice. I simply set a short fuse cookie (1-2 min) with a test variable in the page with my FB Connect button. When FB came back with information to my data parsing/handling script I checked for this cookie where I was redirecting it and if found, directed the user to the proper URL using header:location. Of course some browsers/users etc disable cookies. This obviously wont work there (maybe use a session var and destroy it in the fb data handler?) I am sure there is a better way to do it but at the moment, this bandaid works.
The answer for me was this:
$user = $facebook->getUser();
if (!$user) {
$loginUrl = $facebook->getLoginUrl(array(
'scope' => '',
'redirect_uri' => $this->domain,
));
print('<script> top.location.href=\'' . $loginUrl . '\'</script>');
}
I've been cracking my head a long time before I found this solution, seeming I am not the only one with this issue I hope this works for you to!
I noticed you are using Yii which I'm using as well and had the same problem for half the day. As mentioned, the problem is the special characters in your URL i.e. r=site/oath2 You can fix it by enabling pretty URLS in your config so that your URL becomes index.php/site/oath2 It seems to work without the trailing slash though.
Need to parse weird URL (contains /#/?)
I am asked to work with a service that changes my websites url to: http:://example.com/#/?id=9 I cannot seem to be able to get the id from such URL. $_GET is empty, $_SERVER['REQUEST_URI'] only contains /. How am I supposed to get to the params? Things I have tried: Zend_Debug::dump($_GET); // outputs array(0) echo $_SERVER['REQUEST_URI']; // outputs / Zend_Debug::dump(parse_url($_SERVER['REQUEST_URI'])); // outputs array(["path"] => string(1) "/") I am using Zend Framework but I doubt its something to do with it. Thanks in advance.
You can't parse that with PHP, for the simple reason that as far as the URL concerns, anything beyond the # (hash) is not part of the URL, that part must be parsed with JavaScript or a similar client side language. window.location.hash Will return everything past the hash (including the # character) In short: not possible in server, go with client. (maybe post an ajax call to a server with the GET data)
Everything including and following the # is for the browser's interest only. The server never even sees it.