social_core.backends.facebook.FacebookOAuth2 should have REDIRECT_STATE set to False

[kevingu1003]

I'm new to Facebook Oauth and actually new to the entire Oauth world, so this bug took me very long time to figure out.

Since I'm new I'm forced to use Facebook API v2.10.

When REDIRECT_STATE set to True, PSA will compose authentication url like following:

https://www.facebook.com/v2.10/dialog/oauth?scope=email&redirect_uri=http%3A%2F%2Fexample.com%2Fcomplete%2Ffacebook%2F%3Fredirect_state%3D1TIlS0FPkTctrPCQhgf2rdO3bawWvwdB&client_id=[client_id]&return_scopes=true&state=1TIlS0FPkTctrPCQhgf2rdO3bawWvwdB

And Facebook will reject such kind of url, gives error message like following:

Can't Load URL: The domain of this URL isn't included in the app's domains. To be able to load this URL, add all domains and subdomains of your app to the App Domains field in your app settings.

This the callback url configured on redirect URL doesn't allow redirect_state inside the URL, renders the authentication url invalid.

I'm not sure if older version of Facebook API allows this, but this is the case I'm encountering, and when I override the setting REDIRECT_STATE with a custom backend, Facebook allows me in.

Following is the entire code I'm using now with Facebook API v2.10:

from social_core.backends.facebook import FacebookOAuth2

class FacebookOAuth2Override(FacebookOAuth2):
    REDIRECT_STATE = False

And settings:

SOCIAL_AUTH_FACEBOOK_KEY = 'key'
SOCIAL_AUTH_FACEBOOK_SECRET = 'secret'
SOCIAL_AUTH_FACEBOOK_SCOPE = ['email', 'public_profile']
SOCIAL_AUTH_FACEBOOK_PROFILE_EXTRA_PARAMS = {
  'locale': 'en',
  'fields': 'id,name'
}

Please verify and fix, cheers.

[pszpetkowski]

+1

[tisdall]

@kevingu1003 - thank you for the fix!

[EralpB]

pardon me. can anyone point out the security vulnerabilities of not sending state parameter? is this open to CSRF attacks now? I'm thinking about enabling strict mode and redirect state False vs keeping strict mode off and sending state parameter.

no resources about this and this page is #1 at google results, can someone provide an explanation or link to a resource?