Facebook 400 bad request second time I use app

Question

I only get this error on mobile devices. The redirect to the login works correctly and the user is redirected back to the app correctly. I get no error. Then, if I access the app a second time (seconds after the first use) file_get_contents throws back a 400 bad request - here's the code - help HIGHLY appreciated :-)

$code = $_REQUEST["code"]; if(empty($code)) { $my_url = 'https://m.facebook.com/apps/'.$app_id.'/?sid='.$surveyid.'&country='.$country; $dialog_url = "https://www.facebook.com/dialog/oauth?client_id=" . $app_id . "&redirect_uri=" . urlencode($my_url) . "&scope=user_birthday";

        echo("<script> top.location.href='" . $dialog_url . "'</script>");
        exit();
        }

        $my_url = 'https://m.facebook.com/apps/'.$app_id.'/?sid='.$surveyid.'&country='.$country;
        $token_url = "https://graph.facebook.com/oauth/access_token?"
        . "client_id=" . $app_id . "&redirect_uri=" . urlencode($my_url)
        . "&client_secret=" . $app_secret . "&code=" . $code;

        $response = file_get_contents($token_url);
        $params = null;
        parse_str($response, $params);

        $graph_url = "https://graph.facebook.com/me?access_token=" 
        . $params['access_token'];

        $user = json_decode(file_get_contents($graph_url));

        $me['id']=$user->id;
        $me['gender']=$user->gender;
        $me['first_name']=$user->first_name;
        $me['last_name']=$user->last_name;
        $me['birhtday']=$user->birthday;

Answer 1

Have you checked if the session is available the second time?

I see that the session variable might be missing

Answer 2

Then, if I access the app a second time (seconds after the first use) file_get_contents throws back a 400 bad request

Had you used the PHP SDK instead of doing requests against the API “manually”, you would’ve gotten an exception with an error message that should have explained what’s going on – please consider using it in the future, it makes a lot of things easier, including debugging.

---

As for the current problem, it looks like you are trying to exchange the code parameter for a new access token every time – but this will not possible any more in the future, see https://developers.facebook.com/roadmap/#december-2012, “New security restrictions for OAuth authorization codes”:

We will only allow authorization codes to be exchanged for access tokens once

For newly created apps, this migration is enabled by default – you can disable it for now, and it should be working as expected. But after Dec 5th 2012, you’ll have to have a solution that works without trying to exchange the code for an access token multiple times.