how to read facebook signed_request to get user_id

Question

According to Facebook - Authentication within a Canvas Page Document, they say that we will be getting a signed_request which consists a JSON object. Now they say that signed_request can be get through $_POST['signed_request'] I agree its working for me.

Now according to them if the user is logged in i will be getting a JSON object value like this:-

{
  "expires":UNIXTIME_WHEN_ACCESS_TOKEN_EXPIRES,
  "algorithm":"HMAC-SHA256",
  "issued_at":UNIXTIME_WHEN_REQUEST_WAS_ISSUED,
  "oauth_token":"USER_ACCESS_TOKEN",
  "user_id":"USER_ID",
  "user":{
    "country":"ISO_COUNTRY_CODE",
    "locale":"ISO_LOCALE_CODE",
    ...
  }
}

Now i want to fetch the user_id out of this so i am using this piece of code but its not working:-

if(isset($_POST['signed_request']))
{
    echo 'YES';
    $json = $_POST['signed_request'];
    $obj = json_decode($json);
    print $obj->{'user_id'};    
}

It just print the YES. Why is it so?

I have read somewhere that without app authentication i will not be able to extract the user_id but according to the facebook, this is the 1st step and authenticating the application would be 4th. I am new to it, if somebody can please help me, it will be of great help. Thanks.

@Brad when i `print_r($_POST['signed_request']);` i get exactly this value `cnMQQpKShmtfcXXEAjNrazO7AZxAqCuZ0aIA-k1L-P8.qgytuisdhrl0aG0iOiJITUFDLVNIQTI1NiI‌sImV4cGlyZXMiOjEzNDUwNTM2MDAsImlzc3VlZF9hdCI6MTM0NTA0ODYwOCpoemi1dGhfdG9rZW4iOiJB‌QUFFOGZCWW1sN2NCQUJHVWZIb1VZUGdMcngwdjBURFlSdVFiNHNQR2pSMDRUNnZKZHkzWkFYU2RBYWNiV‌nFtMHJRZTFKZ2lrWkFRWkFJR2RPb0JuQ0JiVGxLOGpuUXlCSVpDWkJsWHdzWG5XbHg5VVZEV1dkIiwicG‌FnZSI6eyJpZCI6IjI2OTY3MDc5NjQ4MDcxOCIsImxpa2VkIjpmYWxzZSwiYWRtaW4iOmZhbHNlfSwidXN‌lciI6eyJjb3VudHJ5IjoiaW4iLCJsb2NhbGUiOiJlbl9JTiIsImFnZSI6eyJtaW4iOjIxfX0sInVzZXJf‌aWQiOiIxNTc2NDU1NjQ5In0` — Django Anonymous, Aug 15 '12 at 16:39
try using `$signed_request = $facebook->getSignedRequest();` — Abhishek, Aug 15 '12 at 16:52

score 8 · Answer 1 · answered Sep 21 '13 at 23:44

If you don't want to work with the FB SDK you can use this snippet of code to get the user_id and other variables (snippet from https://developers.facebook.com/docs/facebook-login/using-login-with-games/)

function parse_signed_request($signed_request) {
  list($encoded_sig, $payload) = explode('.', $signed_request, 2); 

  // decode the data
  $sig = base64_url_decode($encoded_sig);
  $data = json_decode(base64_url_decode($payload), true);

  // confirm the signature
  $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
  if ($sig !== $expected_sig) {
    error_log('Bad Signed JSON signature!');
    return null;
  }

  return $data;
}

function base64_url_decode($input) {
  return base64_decode(strtr($input, '-_', '+/'));
}

This is super effective and easy to implement. Just be careful with the app secret in code. — Mike_K, Jan 09 '20 at 19:48
This will work. It is recommended for implementing new "request for data deletion" too, but it is hard to achive in C# as facebook base64 encoding is not standard. — Marko Prcać, Jul 09 '21 at 11:48

score 4 · Answer 2 · answered Sep 18 '15 at 14:50

Old post I know but wanted to add a reply to Art Geigel's answer (I can't comment directly on it).

Your code snippet is missing the line,

   $secret = "appsecret"; // Use your app secret here

and the complete snippet,

function parse_signed_request($signed_request) {
   list($encoded_sig, $payload) = explode('.', $signed_request, 2); 

   $secret = "appsecret"; // Use your app secret here

   // decode the data
   $sig = base64_url_decode($encoded_sig);
   $data = json_decode(base64_url_decode($payload), true);

   // confirm the signature
   $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
   if ($sig !== $expected_sig) {
      error_log('Bad Signed JSON signature!');
      return null;
   }

   return $data;
}

function base64_url_decode($input) {
   return base64_decode(strtr($input, '-_', '+/'));
}

To answer the original question

To get data from the signed_request, include the functions above and...

$data = parse_signed_request($_POST['signed_request']);

echo '<pre>';
print_r($data);

score 2 · Accepted Answer · answered Aug 15 '12 at 17:27

I think it failed at json_decode($json) because $json is not a valid json string, as you've mentioned in comment about print_r($_POST['signed_request']);.

According to Facebook - Authentication within a Canvas Page Document, the signed_request parameter is encoded and, parsing the signed_request string will yield a JSON object.

if you're using the PHP SDK, just as Abhishek said in the comment, $facebook->getSignedRequest(); will give you the decoded json.

look here for more details on the Signed Request

Hey can I get `the url` with app_id in the iframe to be open in facebook tab — Rohitashv Singhal, Jul 15 '13 at 06:40

how to read facebook signed_request to get user_id

3 Answers3

Linked