Facebook.com server does not support RFC 5746

Question

I have a built-in facebook in the web system (facebook login and some social plugins like comment field, fb: share, activity plugin, etc.).

Everything worked perfectly. but now the day before yesterday, the facebook login button and comment window stopped working on only one page. On other pages, it still works. I even replaced the code with the code of the working pages, but all in vain.

When I click on the login button, pop-ups are not displayed, and in the comments field -

The page you requested cannot be displayed.

One thing, I noticed that I installed the web developer tool in Firefox. It displays an error message only on this page.

api-read.facebook.com:server does not support RFC 5746, see CVE-2009-3555.

Other pages on which facebook works fine this post is not.

The thing I want to ask first is what kind of mistake?

I was looking for CVE 299-3555 that this is some kind of server problem. Is there something wrong in my code or is it a bug from facebook? If this is a problem on my side, then why does the code on other pages still work? I just want to ask where is the problem?

Well, I used the following code:

<div id="fb-root"></div> <script> window.fbAsyncInit = function () { FB.init({ appId: "MY APP ID", status: true, cookie: true, xfbml: true }); FB.getLoginStatus(function (response) { if (response.session) { // HERE I AM SENDING PARAMETER TO LOGIN IN SYSTEM } else { } }); FB.Event.subscribe("auth.login", function (response) { window.location.reload(); }); FB.Event.subscribe("auth.logout", function (response) { // HERE I AM SENDING PARAMETER TO LOGOUT // FROM THE SYSTEM IS USER LOGOIT"S FROM FACEBOOK }); }; (function () { var e = document.createElement("script"); e.src = document.location.protocol + "//connect.facebook.net/en_US/all.js"; e.async = true; document.getElementById("fb-root").appendChild(e); } ()); </script> 

Answer 1

This is a security issue on the Facebook side. But this does not really matter, because in any case, they transmit most of the confidential information, such as the session cookie, on top of plain unencrypted http.

This is not related to your problem.