Facebook PHP SDK - getLoginUrl () - state value

Question

I am using the PHP SDK function getLoginUrl (), which works great for user login. Once a user is redirected back to my page, the URL can take two forms: see the following link: subsection http://developers.facebook.com/docs/authentication/server-side/

Part of the return URL is the state = state value. This value is supposed to be used to prevent cross-query request: http://developers.facebook.com/docs/reference/dialogs/oauth/

Although, using the getLoginUrl () method, I can never set the state value, since it is not one of the parameters: http://developers.facebook.com/docs/reference/php/facebook-getLoginUrl/

So, how can I use the status value to login the user to facebook and prevent CSRF?

Answer 1

So, how can I use the status value to login the user to facebook and prevent CSRF?

This is automatically handled by the PHP PHP SDK . If you are going to write your own Facebook API calls, you will need to send state manually (if desired) according to the Facebook OAuth documentation.

When you create the login URL with BaseFacebook::getLoginUrl() , the first thing the function does is set the CSRF state token ¹ which creates a hash using the PHP kernel mt_rand() , uniqid() and md5() , and also saves value as a session variable.

When a user is redirected back to your page, FBSDK checks to see if the state represented matches state in the session. If the values ​​really match, state is cleared from the Facebook object and from the session, so all subsequent getLoginUrl() requests will receive a new state variable. ²

Theoretically, you can use your own state value with FBSDK by writing it to the fb_<your_app_id>_state session fb_<your_app_id>_state before creating the Facebook object, as a constructor for BaseFacebook and establishCSRFTokenState() both checks if state already exists in the session.

But this is likely to lead to greater complexity than necessary.

---

• see BaseFacebook::establishCSRFTokenState()
• see BaseFacebook::getCode()