Hi all,
I'm using drupal 6.6 with drupal for facebook 6.x-2.0-rc2.
some of my pages are https since i'm using secure pages module, while all is ok without the FB coonect - there are some ssl errors when using FB connect.

While authentication seems to work OK and the app is connecting - after successful login or when i use Facebook connect tab and choose the Primary Connect Application: , all my https pages gets unsecured content alert with all browsers (FF3, chrome, IE8)

Is there a way to bypass this issue? How can I make Drupal for Facebook - FBconnect module to work on my site on all pages - including the https pages as well without all these errors?

BR
Itzhak

Comments

imoreno’s picture

imoreno commented

I have read the README.txt file carefully, still after successful login with face book connect to my site, i get SSL errors from my https page about unsecured content.
Any ideas how to handle this?
It looks like this module is uncompilable with https pages,
Any help would be appreciated.

BR
Itzhak

Dave Cohen’s picture

Dave Cohen commented

I think this is because the modules include the unsecure (regular HTTP) version of the facebook javascript. I have not used HTTPS personally so I don't know exactly the fix. Would gladly consider any patches you send.

It might be easier to address in the 3.x branch, since facebook took down a lot of the documentation for the older libs.

travismiller’s picture

travismiller commented

UPDATE: this breaks the login process though. I have more still to figure out.

I had to update /sites/all/modules/fb/fb_receiver.html to load XdCommReceiver.js via HTTPS. After I made this change, the errors in the browser about unsecured content went away.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<body>
  <!-- Drupal for Facebook cross-domain receiver file. -->
  <!-- http://wiki.developers.facebook.com/index.php/Cross_Domain_Communication_Channel -->
  <script src="https://static.ak.connect.facebook.com/js/api_lib/v0.4/XdCommReceiver.js" type="text/javascript"></script>
</body>
</html>
travismiller’s picture

travismiller commented

The appropriate HTTPS url is: https://ssl.connect.facebook.com/js/api_lib/v0.4/XdCommReceiver.js
@see: http://wiki.developers.facebook.com/index.php/Facebook_Connect_Via_SSL

I duplicated the original fb_receiver.html file and named it fb_receiver-ssl.html and updated it to be:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<body>
  <!-- Drupal for Facebook cross-domain receiver file. -->
  <!-- http://wiki.developers.facebook.com/index.php/Cross_Domain_Communication_Channel -->
  <script src="https://ssl.connect.facebook.com/js/api_lib/v0.4/XdCommReceiver.js" type="text/javascript"></script> 
</body>
</html>

I then updated fb_connect.module:fb_connect_footer():

      $receiver_html = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? '/fb_receiver-ssl.html' : '/fb_receiver.html';
      $receiver = variable_get( 'fb_xd_receiver'
                              , url(drupal_get_path('module', 'fb') . $receiver_html, array('absolute' => TRUE)));

Now log in seems to work properly and there are no "unsecured content" errors in the browser.

Dave Cohen’s picture

Dave Cohen commented
Status: Active » Needs review

Thanks so much for sharing this.

BTW, the 3.x branch does not use the xd receiver. I hope that branch just works as is over HTTPS.

imoreno’s picture

imoreno commented
Version: 6.x-2.0-rc2 » 6.x-3.0-rc4

This problem still consist with the new rc4 release
When using Drupal for facebook on https site (ubercart for instance) you get unsecured content alert with all major browsers (FF, IE, CHROM)

While enabling the module seems to be OK, when integrating the FB connect block on the site it breaks it all.

any suggestions? this could be very useful to gain more sales in drupal sites using ubercart.

imoreno’s picture

imoreno commented
Status: Needs review » Active
Dave Cohen’s picture

Dave Cohen commented

Can you tell exactly what reference is triggering the alert? Is it facebook's javascript?

imoreno’s picture

imoreno commented

It is related to the fb_connect block , once you enable it - it break the HTTPS. either if you are logged with your FB acoount or not.

g.k’s picture

g.k commented

I am able to use fb_connect with ssl/ubercart without any error. You may want to try enabling ssl on pages (user*, fb*, cart*) under admin/build/securepages setting. Once you have enabled ssl, make sure to sync facebook app changes and clear cache, it should fix the error.

imoreno’s picture

imoreno commented

Done that,
Problem still consist after enabling the FB connect block. any other suggestions?

gonz’s picture

gonz commented

maybe it has to do with basePath in the fb_connect.js file?

when it renders in HTML - I can see it pulled in to the page as Drupal extend JS - which gives it a basePath of "/" which seems right - but I really don't see anything else holding it up.

ugg

gonz’s picture

gonz commented
Issue tags: +Ubercart, +Drupal for Facebook, +ssl, +fb connect

I think I found the source of the problem - after debugging for a few hours - I tried to render the a simple SSL page with basically no content or theme - just pure Hello World

The used the Fully Rendered page source (inline scripts and all)

Looks like it is the fb.js file:

<script type="text/javascript" src="/sites/all/modules/fb/fb.js"></script>

in particular - this function:


// JQuery pseudo-event handler.
FB_JS.sessionChangeHandler = function(context, status) {
  // Pass data to ajax event.
  var data = {
    'event_type': 'session_change'
  };

  if (status.session) {
    data.fbu = status.session.uid;
    // Suppress facebook-controlled session.
    data.fb_session_handoff = true;
  }
  FB_JS.ajaxEvent(data.event_type, data);
  // No need to call window.location.reload().  It will be called from ajaxEvent, if needed.
};

If you remove this function - the page loads - there is an IE warning of
error: "guid" is null or not an object

but at least its not kicking us out of our Facebook app.

My experience so far has been - if I try out the SSL Facebook on IE - it will literally warn me on non-secure items - it waits a few seconds while it grabs something from (www.facebook.com/... - I can tell from browser status bar) then it kicks me out of Facebook - redirecting to my drupal hosted site in the parent window.

Oddly enough - this does not happen on Firefox or Safari - I can make a purchase all the way through without any warnings. This seems to be just an IE issue (but unfortunately one that I cannot avoid).

Once I removed that line of code - it allowed me stay on Facebook. of course this is not a fully functioning Drupal /FB site anymore - but hopefully this gives us some more insight.

Dave can you tell from the above function has anything to do with HTTP request vs HTTPS maybe in the session handler?

Does anybody have any working Facebook/Ecommerce sites operational? I would like to get one going and I know other companies are already doing this - just not with Drupal - hopefully we can bridge the gap.

Any thoughts?

Dave Cohen’s picture

Dave Cohen commented

Is this the same problem? #1050582: SSL guide with ubercart and drupal for facebook That user recommends secure pages instead of ubercart ssl.

The function you point out makes an ajax request back to the drupal server. But it *should* be using HTTPS if the original request was HTTPS.

gonz’s picture

gonz commented

I am pretty positive this worked - I just tested on IE6 and IE9 - but you must enter in at https://apps.facebook.com to prevent the SSL warning:

/* http://drupal.org/node/1102878 */

header('P3P: CP="CAO PSA OUR"');

Dave Cohen’s picture

Dave Cohen commented
Version: 6.x-3.0-rc4 » 6.x-3.x-dev
Status: Active » Fixed

I believe this is fixed in the latest release candidate. But please correct me if I am wrong.

Thanks for the tips about https canvas page and P3P header.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

maciej lukianski’s picture

maciej lukianski commented
Status: Active » Closed (fixed)

Hi Dave

It is still a problem in the latest release candidate (rc11).

I get the error when:

  • Page is secure (https://)
  • user is connected to Facebook
  • in the fb_connect block users picture is enabled <fb:profile-pic uid=!fbu></fb:profile-pic>

If I remove the this code, the error goes away. The logout link does not create the error.

In pages source I see that link to users profile is https:// but link to users picture within it is called with <img src="http://" and that is probably the reason for the error, but what causes it, I do not know.

maciej lukianski’s picture

maciej lukianski commented
Status: Closed (fixed) » Active

as above..

bonked’s picture

bonked commented
Status: Closed (fixed) » Active

This most likely related to this: http://bugs.developers.facebook.net/show_bug.cgi?id=15880

Although FB claims to have fixed it - it isn't fixed.

mikeejt’s picture

mikeejt commented

I had this same issue when debugging my issue #1136874: Email Access - Not Retrieving Email. I found a hack/workaround to get this working w/ SSL (Secure Pages module), but w/ an annoying side-effect.

1. Turn off Secure Pages (temporarily).
2. Re-sync your fb app. You'll now notice that your site url, post-authorize callback, and deauthorize callback will now use http (not https).
3. Turn on Secure Pages.

FB connect should now work on your site. However, the annoying side-effect is that your admin pages will display:

The Facebook Application labeled [yourapp] has a suspicious connect_url. The value is http://example.com/, while something starting with https://example.com/ was expected. Consider editing [yourapp].

I hope this workaround/hack is ok and not a security issue. Please let us know if it is.

Edit:
The above workaround is for RC11.

I just tested w/ 6.x-3.x-dev (01 Apr 2011) and it works...sort of. Now it's all or nothing - meaning all your pages have to be https, or none of them can be https.

If you sync/save your FB app w/ https, then all pages that have a login block w/ FB Connect needs to be https (problematic if your whole site has a login block somewhere on the page). If you don't have it w/ https, then only the text "Connect" shows up w/out the image and link.

hanoii’s picture

hanoii
Primary language Spanish
Location 🇦🇷UTC-3
commented

hmm, I am bothered with the warning, I am using ubercart and secure pages, the warning says:

The Facebook Application labeled myglobalthesis has a suspicious connect_url. The value is http://example.com/, while something starting with https://www.example.com was expected. Consider editing myglobalthesis.

Is this warning really necessary, for now I am not experiencing bugs, although I have the settings configured to use http for now.

Secure pages allow some content not to be SSL and that should be the standard handled use case.

Shall fb module ignore this warning if the only difference is the SSL?

Can someone sum up the current bugs of using Secure Pages?

Thanks!

Dave Cohen’s picture

Dave Cohen commented

The message comes from fb_devel.module. It is intended to catch another problem. Probably it should not warn when the difference is only http vs https. Regular users should not see the warning, and I believe it is safe to ignore in this case.