Facebook SDK returned an error: Cross-site request forgery validation failed. The “state” param from the URL and session do not match

Question

i\'m trying to get Facebook user id using the php sdk like this

$fb = new Facebook\\Facebook([
    \'app_id\' => \'11111111111\',
    \'app_secret\' =>         


        

Answer 1

I am playing around with Symfony and was having this problem one attempt yes and the next one no. I solved this problem by storing the facebookRedirectLoginHelper object into session, and retrieving it later on from the session instead of asking the Facebook object for it again.

The documentation (Symfony 4.3 at the time of this writing) states the following:

Make sure your PHP session isn't already started before using the Session class. If you have a legacy session system that starts your session, see Legacy Sessions.

Symfony sessions are designed to replace several native PHP functions. Applications should avoid using session_start(), session_regenerate_id(), session_id(), session_name(), and session_destroy() and instead use the APIs in the following section.

While it is recommended to explicitly start a session, a session will actually start on demand, that is, if any session request is made to read/write session data.

So I think that retrieving the object from the session inherently starts the php session.

If you are using some php framework, keep that in mind.