IFRAME 中的访问代码更新
我有一个 iframe，在其中显示一些用户的 Facebook 信息。当我的服务器生成 iframe 的内容时，它会检查来自 Facebook 的响应，表明访问代码已过期，并设置在 iframe 内发生的重新身份验证序列，这对于用户来说是最不明显的。但是，如果服务器检测到用户未登录，它将跳出到新的浏览器窗口以引导用户完成注册。
最近，我注意到我的 iframe 往往会变成空白。问题似乎是，Facebook API 有时会报告访问代码已过期，而实际上用户甚至没有登录。尝试更新访问代码会导致 Facebook 重定向到登录页面。但登录页面带有“X-Frame-Options:DENY”标头，因此浏览器拒绝在我的 iframe 中显示任何内容。一旦我调用 URL 来更新访问代码，我就无法控制此过程，并且由于 iframe 中的内容位于不同的域中，托管页面甚至无法检测到这种情况何时发生。
有人知道这个问题的解决方案吗？理想情况下，Facebook API 会更准确地报告过期的访问令牌，但如果做不到这一点，如果我可以将登录页面设置为重定向到新窗口，那就太好了。
I have an iframe where I display some of the user's Facebook information. When my server generates the content for the iframe, it checks for responses from Facebook indicating that the access-code has expired, and sets up the re-auth sequence to occur inside the iframe, where it will be the least noticeable to the user. If, however, the server detects that the user is not logged in, it will bounce out to a new browser window to lead the user through sign-up.
Lately, I've noticed my iframe tends to go blank. The issue appears to be that occasionally the Facebook APIs will report an access-code as expired when, in fact, the user is not even signed in. Attempting to renew the access-code causes Facebook to redirect to the login page. But the login page is served with 'X-Frame-Options:DENY' Header, so the browser just refuses to display anything in my iframe. I don't have any control over this process once I invoke the URL to renew the access code, and since the content in the iframe is on a different domain, the hosting page can't even detect when this situation has happened.
Anybody know of a solution to this? Ideally, the Facebook APIs would more accurately report on expired access tokens, but failing that, it would be nice if I could set the login page to be redirected to a new window.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论