Site structure for multiple page Facebook Canvas app

1
votes

This may seem like an obvious problem, but I have looked on the facebook developers site regarding canvas apps, and on the facebook csharp sdk and have not found an answer to my questions.

I'm using the facebook-c#-sdk v5.4x or something abouts, .net 3.5 using webforms.

The canvas app for desktop will have multiple entry points.

https://apps.facebook.com/my_canvas_app/Default.aspx
https://apps.facebook.com/my_canvas_app/Register.aspx?EventID=12345
https://apps.facebook.com/my_canvas_app/SomeOtherPage.aspx

My first question is that from the first request from facebook, I receive the signed_request (which facebook-c#-sdk takes care of), I have the oauth token, which is valid for approximately 2 hours. What is the correct way to re-new this oauth token, and ensure it's valid before trying to make an oauth request (query the graph, etc.)?

Right now all my links (say from Default.aspx) look like <a href="https://apps.facebook.com/my_canvas_app/SomeOtherPage.aspx" target="_top">Go to Some Other Page</a>, which ends up doing a round trip to facebook, getting a new signed_request, and thus a renewed oauth token.

Secondly, When doing a regular form postback though asp.net to my own site, I ensure the signed_request is on the form with a simple <input type="hidden" name="signed_request" value="<%=Request.Form["signed_request"]%>" />, which seems to work fine for the the application. If I omit this then the postback does not have the oauth information, resulting in things failing. Is this the correct way to perform a postback in a canvas app? From what I can see from viewing the source of the csharp-sdk that nothing is stored in the session to preserve the oauth token between requests, so the hidden input, and target="_top" links are required for multiple pages / postbacks, am I correct in this deduction?

Thirdly, when developing the mobile canvas app (without the iframe), do all the links on my page still have to go to https://apps.facebook.com/my_canvas_app/MobilePage.aspx, if my first assumption is correct that is.

If anyone could shed some light on these subjects I would be greatly appreciated.

Thanks!

2
asp.netfacebook-graph-apifacebook-c#-sdkwebformsfacebook-canvas

2 Answers

2
votes

Right now all my links (say from Default.aspx) look like Go to Some Other Page, which ends up doing a round trip to facebook, getting a new signed_request, and thus a renewed oauth token.

I'd suggest also embedding the JavaScript SDK into your pages - a call to FB.getLoginStatus then should also get you a valid access token every time. The other thing you could do, is exchange that short-time access token you get at user login for a long-time one, see https://developers.facebook.com/roadmap/offline-access-removal/

If you don't save your access token into some kind of session, then I guess you'll have to transfer it from page to page via postback, yes.

(And maybe you should take a look at https://developers.facebook.com/docs/authentication/access-token-expiration/ as well.)

0
votes

What I am doing is using the signed_request on a per-page basis. All links in the desktop environment go to http://apps.facebook.com/myappnamespace/MyPageName.aspx with a target="_top", this way every page change gets an updated oauth token. Mobile operates differently as signed_request is not available for the mobile experience. The solution for this is to use server side authentication instead. I am not using http://apps.facebook.com/myappnamespace for the mobile environment as it's not within an iframe. Mobile operates like any other regular website.