FB tab page aplication and safari bug of session

Question

I have a problem..

I try wrote program like as facebook page tab app. I must use session for remember signed_request.

But issue is that Safari do not remember session.

Program is:

$facebook = new Facebook($config);
      if (isset($_REQUEST['signed_request'])) {
            $encoded_sig = null;
            $payload = null;
            list($encoded_sig, $payload) = explode('.', $_REQUEST['signed_request'], 2);
            $sig = base64_decode(strtr($encoded_sig, '-_', '+/'));
            $signed_request = json_decode(base64_decode(strtr($payload, '-_', '+/'), true),true);
            $op=True;
        }else {
            $op=False;
        }

if($op)
{
  $_SESSION['liked']=$signed_request['page']['liked'];
  $_SESSION['admin']=$signed_request['page']['admin'];

}else{
  $url="PAGEAPP URL";
  echo("<script> top.location.href='" . $url . "'</script>");
  exit();
}

score 0 · Answer 1 · edited May 23 '17 at 10:25

0

Safari does not allow cross domain cookies.

As the main page is of the domain Facebook.com and your iframe domain differs, Safari will not process cookies inside the iFrame.

Although there are workarounds for other browsers, and at one point there was a workaround for Safari, it seems Apple closed this loophole.

http://anantgarg.com/2010/02/18/cross-domain-cookies-in-safari/

Setting cross-domain cookies in Safari

Although I can't see your full code & scenario, I would suggest you avoid using sessions, and always query the Facebook API to check for the 'liked' & 'admin' flags. If a user's admin privileges were revoked, or a user disliked the page, then your SESSION variables would become out of sync (unless you are constantly updating your SESSION variables).

Check if a user liked the page: How to check if current facebook user like a page using PHP SDK?

Check if a user is an admin: How to get if a user is admin of a page (isAdmin) using the Facebook Graph API?

edited May 23 '17 at 10:25

Community

1
1

answered Apr 09 '14 at 10:54

fuzzysearch

846
9
15

http://anantgarg.com/2010/02/18/cross-domain-cookies-in-safari/ is not found. I can not use "$facebook->api("/me/li.." because I don´t have access_token. I must use signed_request. – Veronika Blahoslavová Apr 09 '14 at 15:26
Are you trying to use session variables in case the user leaves and then returns to the app? Or is it to store their state while moving between different pages of your app? – fuzzysearch Apr 09 '14 at 15:34
I use session to menu. Because user go to page.php from index.php. On page.php after signed_request not found. link to page.php is normal Page – Veronika Blahoslavová Apr 09 '14 at 16:05
have tris script in php ? – Veronika Blahoslavová Apr 09 '14 at 16:36

FB tab page aplication and safari bug of session

1 Answers1