I have received the following email from Facebook and I don't really understand it enough to know what I need to look at. My app allows for facebook connect login, and I also have functionality that allows users to upload photos from my site to their profiles. So I'm not sure which this email is related too, so any advise would be appreciated.

Dear Developer,

Our automated systems have detected that you may be inadvertently allowing authentication data to be passed to 3rd parties. Allowing user ids and access tokens to be passed to 3rd parties, even inadvertently, could allow these 3rd parties to access the data the user made available to your site. This violates our policies and undermines user trust in your site and Facebook Platform.

In every case that we have examined, this information is passed via the HTTP Referer Header by the user's browser. This can happen when using our legacy authentication system and including

, Only local images are allowed. or content from 3rd parties in the page that receives authentication data from Facebook. Our legacy mechanism passes authentication information in the URL query string which, if handled incorrectly, can be passed to 3rd parties by the browser. Our current OAuth 2.0 authentication system, released over a year ago, passes this information in the URL fragment, which is not passed to 3rd parties by the browser. Please ensure that you are not allowing this data to be passed immediately. Accessing your site as a test user while running a HTTP proxy/monitor like Charles or Fiddler is the best way to determine if you are allowing this information to be passed. Using Charles or Fiddler, search the session trace for your Facebook user id (can be found by going to graph.facebook.com/username while signed in) or "session." See if the Facebook user id or access token is getting sent in the referrer header to any 3rd parties other than you and Facebook. If you discover the issue, you can do one of two things: 1. Migrate your site to use our OAuth 2.0 authentication system. We are requiring all apps and sites to update to this mechanism by Sept. 1, 2011. Migrating now will address this issue and ensure that you are one of the first to meet the deadline. For more details, please see our Authentication Guide. 2. Create and use an interstitial page to remove the authentication data before redirecting to your page with 3rd party content. This approach is used by many of our largest developers today (although they are all migrating to OAuth 2.0 shortly). This is a simple and straightforward change that should have minimal impact on your site. For more details on this approach, see our Legacy Connect Auth doc. Because of the importance of ensuring user trust and privacy, we are asking you to complete one of the above steps in the next 48 hours. If you fail to do so, your site may be subject to one of the enforcement actions outlined in our policies. If you have any questions or believe you have received this message in error, please contact us. Thanks, The Platform Policy Team

Comments

bropp’s picture

bropp commented

I have just received the exact same email about my website. I'm using the FB Connect feature on the site. Does anyone have any ideas? Thanks.

jfolwarski’s picture

jfolwarski commented

We received the same email. Just started searching if any one has fixed it yet. I believe the issue is with the 'fbu' get param. When you click on an external site link the referer data has the 'fbu' get param included which gives outside sites info about the facebook user. At least that's what we believe the issue to be.

Dave Cohen’s picture

Dave Cohen commented
Title: Email from Facebook regard authentication data » Email from Facebook, "Action Required for app"
Version: 6.x-3.0-rc14 » 6.x-3.x-dev
Category: support » bug
Priority: Normal » Major

I also believe the issue is #2.

Please try this patch http://drupal.org/node/1216626#comment-4764762. Apply patch and refresh Drupal's caches.

I'm not sure we'll get any immediate feedback from facebook. But if that is the problem, that patch should fix.

bropp’s picture

bropp commented

Thanks for the quick reply. I'll apply the patch and let you know if I hear anything more from fb.

jfolwarski’s picture

jfolwarski commented

Thanks a lot Dave for the quick response. Patch is so far working like a charm. We'll now have to wait and see if facebook thinks so as well.

udipl’s picture

udipl commented

Thank you Dave for the quick response.

That intimidating message from Facebook also mentioned the September expiration of the old SDK.
Do you have any plans to migrate to the new 3.0 SDK?

supadits’s picture

supadits commented

I also got the same email this morning.
I will try apply patch. Let's see

maciej lukianski’s picture

maciej lukianski commented

subscribing. guess everyone got the email :)

pieter_duijves’s picture

pieter_duijves commented

subscribing. got the same mail today...

mike.darke’s picture

mike.darke commented

subscribing. I've just received the email too. Going to apply the patch and keep my fingers crossed!

rayvan’s picture

rayvan commented

would this patch work with 3.0-rc1?

bobafred’s picture

bobafred commented

Thanks, Dave.

@udipl asks a good question. Are there plans to migrate to the latest authentication model?

Dave Cohen’s picture

Dave Cohen commented

I plan to make a 4.x branch to migrate to the updated PHP SDK, which they call 3.0.0. But we cannot use that until they release the corresponding Javasript SDK, which AFAIK they have not done.

Interested parties should follow #1166272: Upgrade Your App to OAuth 2.0 and HTTPS by October 1st (a.k.a undefined method Facebook::getSession())

bropp’s picture

bropp commented

Just to let you know Dave (because I saw you wrote about it in the other issue where the patch was), I had to reenable the option to put the hash in the query string because I was getting infinite refreshes after a user logged out. I'm using varnish for caching, so it just kept loading the cached page.

Dave Cohen’s picture

Dave Cohen commented
Status: Active » Fixed

I don't know much about varnish or its configuration options, but it would be nice if it could be configured to not cache (or pull from the cache) when a user is connected to facebook. I assume there's a way to not cache when the user is logged into drupal, so I imagine there's a way to set it up for facebook.

Any discussion about that should be moved to the other thread (or a new thread). Let's not use this thread for that.

I'm tagging this issue fixed because the change is in rc15. If it turns out to not be fixed, please let me know.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.