Bug when using a valid access token by invalid appsecret_proof that is disabled

[mvcmaker]

Hi,
I'm using the latest version of the sdk (5.5.0)
I've unset the appsecret_proof in the app advanced config, but when I use a valid access token got directly from the api tools. But I get all the time the next error:

Invalid appsecret_proof provided in the API argument

This is a code issue, due I'm using the main README.md code that should works but don't. Please, check it and fix it this, so we can not use que facebook until now.

[yguedidi]

@mvcmaker do you get an access token from the API tools for the right app?

[mvcmaker]

Of course, in fact, this access token works fine when I use the graph tools with my app account.

[SammyK]

This happens when your app secret doesn't match the app that the access token belongs to. So make sure to double check that. If it's still not working, can you post some code?

[mvcmaker]

Of course, here you have:

This code is in my constructor:

		$this->fb = new \Facebook\Facebook([
			'app_id'=>FB::APP_ID,
			'app_secret'=>FB::APP_SECRET,
			'default_graph_version'=>FB::DEFAULT_GRAPH_VERSION,
			//'default_access_token'=>FB::SAMPLE_ACCESS_TOKEN, //Optional,

			//'appsecret_proof'=>$appsecret_proof
		]);

And the next code is on the method that I want to check the user existence:

try {
		  // Get the \Facebook\GraphNodes\GraphUser object for the current user.
		  // If you provided a 'default_access_token', the '{access-token}' is optional.
		  $response = $this->fb->get('/me'/*?fields=id,name,email'*/, $fbToken);
		  //$response = $this->fb->get('/me?fields=id,name,email&appsecret_proof=' . $appsecret_proof, $fbToken);
		} catch(\Facebook\Exceptions\FacebookResponseException $e) {
		  // When Graph returns an error
		  $this->lastError = 'Graph returned an error (accessToken ' . $fbToken . '): ' . $e->getMessage();
		  return false;
		} catch(\Facebook\Exceptions\FacebookSDKException $e) {
		  // When validation fails or other local issues
		  $this->lastError = 'Facebook SDK returned an error: ' . $e->getMessage();
		  return false;
		}

		$me = $response->getGraphUser();
		echo 'Logged in as ' . $me->getName();
		return true;

[yguedidi]

@mvcmaker what https://developers.facebook.com/tools/debug/accesstoken/ says?

[mvcmaker]

Tells that's all it's ok

[mvcmaker]

php-graph-sdk automatically sends appsecret_proof key when sending both, post or get requests, and this can not be modified directly without modifyin the main framework, but out configuration has appsecret disabled, this is the reason of working using the debug tools and not the the github sdk code. Still more, the code that gives you facebook to use the php-graph-sdk doesn't works, is deprectaed of a sure old api.

[yguedidi]

@mvcmaker and the credentials configured for the SDK are exactly the same than the credentials of the application linked to the access token in Access Token Debug Tool?
By exactly I mean beware of any hidden character at the begining or the end of the app id and app secret.

I don't think this is an issue in the SDK, overwise the SDK will be unusable, and not only you will complain about this :)
I'd suggest you to ask on StackOverflow for your issue, as the GitHub issue tracker is for SDK issues or feature suggestion.

[mvcmaker]

Yes, are the same. It's an issue of the SDK, due when I call directly using curl by get, and ommitign the get request var appsecret_proof, the response is the expected, but when I use the $fb->get() method, the result is always the unexpected error that is the main reason of this post.

[mvcmaker]

stackoverflow has just passed away through my post, no response, no answers. Has been 100% omitted by everybody.

[yguedidi]

please var_dump($appSecret) and var_dump($this->value) just before the return here: https://github.com/facebook/php-graph-sdk/blob/5.5/src/Facebook/Authentication/AccessToken.php#L70
Is the access token the one you provide? is the secret the one you provide?

[mvcmaker]

Yes of course, the same

[mvcmaker]

Can you give me please, a contact mail of a facebook technitian? This is a problema that must solve facebook, no github, it's a facebook problem, for two reasons: The first is that the sdk they provide doesn't work, the second is that the code they give to use it doesn't work neither, due is calls a method that doesn't exists.

[yguedidi]

the appsecret_proof behavior is unit tested, it should work, so if you manage to provide use a failing test, it would be easier to solve your issue. Please open a PR with the failing test.

[mvcmaker]

What is a PR? I'm new in github.