My site's login process is suddenly failing this morning (June 19), suspiciously after the announced Facebook JS SDK changes went into effect:

As announced in https://developers.facebook.com/blog/post/2012/05/16/platform-updates--o... we have now removed access to all non-function properties and all function properties prefixed with `_` from the global FB object.

If you experience issues, please verify that you are not relying on anything not documented in our documentation: https://developers.facebook.com/docs/reference/javascript/.

There are definitely references that seem like this in fb.js, like the request for the apiKey in window.fbAsyncInit:
if (FB._apiKey && Drupal.settings.fb.get_login_status) {

Is this in fact a problem / are other people seeing this? I'm not running the absolute latest dev version, but I checked the code for it and the references to things like FB._apiKey are there as well. Any insights?

Comments

Dave Cohen’s picture

Version: 6.x-3.2 » 6.x-3.x-dev
Assigned: Unassigned » Dave Cohen
Priority: Normal » Critical

Yeah, it looks like there are some problems on drupalforfacebook.org right now, too.

Although the problem I'm seeing is with logging out. Logging in still seems to work.

jim_at_miramontes’s picture

Version: 6.x-3.x-dev » 6.x-3.2
Assigned: Dave Cohen » Unassigned
Priority: Critical » Normal

Forgot to mention: a console.log() at the beginning of window.fbAsyncInit reported FB._apiKey is undefined.

jim_at_miramontes’s picture

Is there another way to get at what was FB._apiKey? I've been looking through the API spec, but haven't found it yet.

Dave Cohen’s picture

Version: 6.x-3.2 » 6.x-3.x-dev
Priority: Normal » Major

The idea behind checking FB._apiKey is to determine for sure that the javascript was initialized for a specific application. apikeys were deprecated, so this number became the app id.

As far as I can tell, there is no longer anything in the JS api to replace this. There are functions like FB.getAccessToken() and FB.getAuthResponse() which might serve a similar purpose. I'm experimenting with those.

Dave Cohen’s picture

Status: Active » Needs review
StatusFileSize
new5.15 KB

Here's what I'm testing. Please test too!

(Note, if using 6.x-3.2, upgrade to 6.x-dev first, then apply patch)

Dave Cohen’s picture

Title: Is DFB broken by JS SDK changes? » modules/fb broken by recent changes to facebook js platform
StatusFileSize
new5.16 KB

Here's a similar patch for d7.

Would appreciate some feedback before I push these fixes.

jim_at_miramontes’s picture

Score! (so far, anyway :) Login and logout are both working. If I bump into anything else, I'll be sure to post.

Dave Cohen’s picture

I've pushed these patches into the .dev builds. I plan to tag a 3.3 release shortly, but would like to hear from other users whether or not these builds work. Please test the .dev build if you can.

hacmx’s picture

yes sir, it's working in 6.x-3.x-dev + patch fb_js.diff.
Thanks for the fix. More changes are coming from facebook. No errors for now.
greetings!

james.williams’s picture

This line:

setTimeout("FB_JS.initFinal({'session' : null})", 5000); // 5000 = 5 seconds

surely causes issues, since it will be called when logged in with a Facebook-connected user whatever happens, but it will pass through to later code in FB_JS.authResponseChange that will set the status.changed property to true, when the status hasn't changed. This means the page refreshes, because it thinks the user has logged out, when they haven't. The line above is in place because FB.getLoginStatus() is apparently broken, according to the comment above the line. Is FB.getLoginStatus() still broken, because if not, we can remove this line that actually causes a problem?

Dave Cohen’s picture

I hate introducing hacks like that, but I find myself doing it over and over trying to get facebook's junk to work. You'll see there's a line in initFinal() to prevent exactly the problem you describe.

And it remains the case, there is no guarantee that FB.getLoginStatus() will ever call its callback. The geniuses over at facebook describe this as "by design", and its not just me.

james.williams’s picture

Ah - I was looking at the D6 branch. The master branch includes the FB_JS._calledInitFinal variable, which is exactly the fix I was expecting, but the 6.x-3.x branch doesn't have this, so suffers from the infinite looped refreshing. Please can we have that added for D6 when this gets committed?

jherencia’s picture

I think this patches are in the new beta, and fixed my problems.

RTBC?

Dave Cohen’s picture

StatusFileSize
new1.02 KB

Earlier patches are committed. Mostly this is fixed, but since James mentioned the other problem in this thread, I'll just take care of it here.

The attached patch should make d6 work similar to d7. Unfortunately the two versions are out of sync. D6 has a bunch of options to control how the login status is learned, a lot of which was just experimenting on my part. I'm not sure all those options are really useful.

Anyway, at least James, please look over this patch.

james.williams’s picture

It looks good from just looking at it, though I haven't tested it. Is there a good reason for the different parameter sent to FB_JS.initFinal though? It was {'session' : null} in the D7 version, but {'authResponse' : null} in this D6 one. I expect that was a mistake and it should be the former?

I've kind of lost track of where the D6 branch has diverged, I'm mostly maintaining D7 sites with this module now.

Dave Cohen’s picture

Mostly the 6.x branch is ahead of 7.x. I have a handful of patches to 6 that haven't yet been pushed to 7. I'm pretty sure this change got into 7, and not 6, because I was working on an app at the time where getLoginStatus was not returning. Its a pain to set that up to properly test a change like this.

I think a smaller change is better. As long as the right param is being passed to initFinal. I'm pretty sure 7.x will look more like 6.x when it has caught up with all patches.

mayur.pimple’s picture

i have same problem with google chrome.
error is : FB.logout() called without an access token.

kingsoton’s picture

the newest means facebook characteristics, despite the fact that a lot of the adjustments have been built to enable organizations and romantic facebook status manufacturers socialize with less effort along with prospective customers.

mayur.pimple’s picture

Thanks it's works great... :)