Facebook PHP-SDK with CodeIgniter not returning $_REQUEST['signed_request']

Question

class Example extends CI_Controller {

    function __construct()
    {
        parent::__construct();
    }

    function index()
    {

        $this->load->library('facebooklib');

        $user = $this->facebooklib->getUser();

        if ($user) {
            try {
                $data['user_profile'] = $this->facebooklib->api('/me');
            } catch (FacebookApiException $e) {
                $user = null;
            }
        }

        var_dump($_REQUEST);

        if ($user) {
            $data['logout_url'] = $this->facebooklib->getLogoutUrl();
        } else {
            $data['login_url'] = $this->facebooklib->getLoginUrl();
        }

        $this->load->view('view',$data);
    }
}

After clicking on the Login link, I am taken to Facebook permissions page, I accept, and I am returned to the same page with no data.

array(3) {
  ["/example"]=>
  string(0) ""
  ["PHPSESSID"]=>
  string(32) "33a446883d4fb1877fb6dcff6d70799a"
  ["ci_session"]=>
  string(311) "a:4:{s:10:"session_id";s:32:"d8bb3926550e3ec1b9d075b456708e9b";s:10:"ip_address";s:9:"127.0.0.1";s:10:"user_agent";s:120:"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.168 Safari/535.19";s:13:"last_activity";i:1336011855;}c874fb95984396f04ab6cc17217102d7"
}

My $_REQUEST dump doesn't really show signed_request, which is a problem.

Answer 1

Despite all the downvotes, I was able to find the solution to this VERY serious BUG found in Facebook PHP-SDK with CodeIgniter.

So here's the solution found in CI forums: http://codeigniter.com/forums/viewthread/202370/#986781

    // Stop cache
    $this->ci->output->set_header("Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0");
    $this->ci->output->set_header("Pragma: no-cache");

    // IE Fix
    if(strpos($this->ci->agent->agent_string(), 'MSIE') !== FALSE) {
        $this->ci->output->set_header('p3p: CP="ALL DSP COR PSAa PSDa OUR NOR ONL UNI COM NAV"');
    }

    // Repopulate _REQUEST ... Facebook needs it.
    $request_uri = $_SERVER['REQUEST_URI'];
    $request_uri = explode('?',$request_uri);
    if(count($request_uri) > 1) {
        parse_str($request_uri[1], $_REQUEST);
    }

For some reason, the new PHP SDK doesn't pass $_REQUEST through CodeIgniter. There's also issues with cache, and IE not having proper header.

So this builds $_REQUEST from $_SERVER['REQUEST_URI'], which then properly passes through Facebook class and successfully returns proper data.

Answer 2

Use this instruction this might help

$signed_request = isset($_REQUEST['signed_request']) ? $_REQUEST['signed_request'] : $this->modelfacebook->signRequest();

Answer 3

According to one of the answers in this post, CodeIgniter purges the $_REQUEST variable for security reasons. I assume it's related to the automatic input filtering described in the Codeigniter Manual here, but it's not specifically mentioned there either though. I am unsure whether setting

 $config['global_xss_filtering'] = TRUE;

in config.php affects it or not (I have it set to TRUE in mine), but at least now you/we know why the $_REQUEST variable is not available.

Interestingly, I have the FB SDK library in my CIApplication/libraries/ folder and it seems to access the $_REQUEST variable fine, just not in my views or controllers.

Was looking for the answer to the same question when I came across this post - and yours is a perfectly valid, good question too!

Cheers Matt