有时 Facebook 在身份验证期间不会返回 auth_nonce 参数
我在服务器端身份验证流程中使用 auth_nonce 参数。但是，我遇到一个问题，有时 Facebook 在最后一步中不返回 auth_nonce 参数，这当然会导致身份验证失败。
通常它工作得很好。这些情况是当用户最初登录我的应用程序时，我请求 Facebook 重新对他们进行身份验证 (auth_type=reauthenticate)。我从来没有见过这样的失败。
当它失败时，总是在用户登录之后，并且他们的 auth_token 已过期，并且我在页面加载之间默默地重新验证它们以获取新的 auth_token。
在后一种情况下，URL 重定向看起来像这样：
http://myapplication.url（注意到令牌已过期，因此将用户发送到...）https://www.facebook.com/dialog/oauth?client_id={APP_ID}&redirect_uri=http%3a%2f%2fmyapplication%2eurl%2ffacebook%2fafterlo gin&scope=列表、of、permissions&display=page&auth_nonce=Vr6EgapnMFIKrbMtVrdcZDTbioGe715pWDtMveA8z4xVNMR5IzGYoPN3rSxf（Facebook 将他们重定向到...）https://www.facebook.com/dialog/permissions.request?app_id={APP_ID}&display=page&next=http%3A%2F%2Fmyapplication.url%2Ffacebook%2Fafterlogin& amp;response_type=code&auth_nonce=Vr6EgapnMFIKrbMtVrdcZDTbioGe715pWDtMveA8z4xVNMR5IzGYoPN3rSxf&fbconnect=1&perms=list%2Cof%2Cpermissions（最后，我们被重定向回...）http://myapplication.url/facebook/afterlogin?code={Big long code here}#_=_
在最后一次通话中，我得到以下网址：
https://graph.facebook.com/oauth/access_token?client_id={APP_ID}&redirect_uri={THE_PROPER_REDIRECT_URL}&client_secret={APP_SECRET}&code={这里是长代码}
我收到的回复格式为：
access_token={AUTH_TOKEN}&expires=5083
根据文档（以及我在正常身份验证期间的经验），最终回复中应该有一个我可以验证的 auth_nonce 参数。
我在这里做错了什么吗？
I am using the auth_nonce parameter during the server-side authentication flow. However, I'm getting a problem where sometimes Facebook doesn't return the auth_nonce argument in the final step, which of course causes the authentication to fail.
Often it works just fine. These cases are when the user is initially logging in to my application, and I request that Facebook reauthenticate them (auth_type=reauthenticate). I've never seen this fail.
When it does fail, it's always after the user has logged in, and their auth_token has expired, and I'm silently reauthenticating them between page loads to get a new auth_token.
In these latter cases, the URL redirection looks something like this:
http://myapplication.url(notices token is expired, so sends the user to...)https://www.facebook.com/dialog/oauth?client_id={APP_ID}&redirect_uri=http%3a%2f%2fmyapplication%2eurl%2ffacebook%2fafterlogin&scope=list,of,permissions&display=page&auth_nonce=Vr6EgapnMFIKrbMtVrdcZDTbioGe715pWDtMveA8z4xVNMR5IzGYoPN3rSxf(Facebook redirects them to...)https://www.facebook.com/dialog/permissions.request?app_id={APP_ID}&display=page&next=http%3A%2F%2Fmyapplication.url%2Ffacebook%2Fafterlogin&response_type=code&auth_nonce=Vr6EgapnMFIKrbMtVrdcZDTbioGe715pWDtMveA8z4xVNMR5IzGYoPN3rSxf&fbconnect=1&perms=list%2Cof%2Cpermissions(Finally, we get redirected back to...)http://myapplication.url/facebook/afterlogin?code={Big long code here}#_=_
During that last call, I GET the following URL:
https://graph.facebook.com/oauth/access_token?client_id={APP_ID}&redirect_uri={THE_PROPER_REDIRECT_URL}&client_secret={APP_SECRET}&code={Big long code here}
The reply I get back is in the form:
access_token={AUTH_TOKEN}&expires=5083
According to the documentation (and my experience during normal authentication), there should be a auth_nonce parameter in the final reply which I can validate.
Am I doing something wrong here?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论