Error on Login using Facebook PHP SDK with Strict Mode Enabled

Question

I got a notification from Facebook saying that they will invalidate calls from URIs not listed in the Valid OAuth redirect URIs this coming March 2018 and I think they are requiring us to Enable Strict Mode for Redirect URIs. Link about this can be found here.

I have been using their PHP SDK with Strict Mode disabled for a year now without any problem however when I do enable strict mode and place there the redirect url which is: https://nino-dot-dynamic-osprey-93721.appspot.com/admin/fb-callback_admin.php - it returns an error as seen below each time I try to Login with Facebook:

Graph returned an error: Can't Load URL: The domain of this URL isn't included in the app's domains. To be able to load this URL, add all domains and subdomains of your app to the App Domains field in your app settings.

Note that I'm simply using FB's default PHP SDK Login code (https://developers.facebook.com/docs/php/howto/example_facebook_login) which have login.php and fb-callback.php links and I'm not using any custom OAuth workflows.

I noticed that the redirect URL generated contains the code and state parameters:

site.com/admin/fb-callback_admin.php?code=somecode&state=somestate

I think this is the reason why I'm getting the error because it only expects a redirect URL of https://nino-dot-dynamic-osprey-93721.appspot.com/admin/fb-callback_admin.php without any trailing parameters.

How do you guys think of getting around this issue of Enabling Strict Mode given that the response of the redirect URL through the below code:

$helper = $fb->getRedirectLoginHelper();
$permissions = ['email']; // Optional permissions
$loginUrl = $helper->getLoginUrl('https://nino-dot-dynamic-osprey-93721.appspot.com/admin/fb-callback_admin.php', $permissions);
echo htmlspecialchars($loginUrl);

is generated from FB's PHP SDK by default?

Answer 1

Change

$accessToken = $helper->getAccessToken()   

to

$accessToken = $helper->getAccessToken('http://www.example.com/admin/fb-callback_admin.php');

I had the same issue and found this answer in this thread, which seems to resolve the problem for me:

Graph returned an error: Can't Load URL: The domain of this URL isn't included in the app's domains

Not sure why this works, though, but glad it did.