Facebook API: IP Address blocking of Heroku servers

Question

I keep having the following error in my Heroku PHP facebook app logs:

[app web.20] PHP Fatal error: Uncaught OAuthException: (#5) Unauthorized 
source IP address\n thrown in /app/www/sdk/src/base_facebook.php on line 1238

I also noticed that the same servers keep producing this error until I recycle the processes (ie in the case above it would be web.20 and web.6 that keep failing repeatedly), but after heroku ps:restart it would be different servers that keep failing.

Now after doing some research I noticed that people kept advising I whitelist my server IP in the Facebook App -> Advanced Settings page, meaning that Facebook keeps a list of blacklisted IPs and this is where you can allow access to them one by one.. which had me wondering why Facebook clearly encourages its users to use Heroku for its facebook apps, while at the same time black-listing its servers.

So basically:

1. Heroku is Facebook's hosting partner
2. Heroku provides its users with unpredictable IP addresses every time the app is recycled
3. And Facebook has blacklisted many of Heroku's servers (around 1 in 10 by my count)
4. So you can never be guaranteed you app is going to get access to its API for all your requests

My question is:

How are developers like me expected to configure production-ready apps in a Facebook-sponsored Heroku environment that clearly is bound to fail around a good chunk of API requests?

Answer 1

This is weird. We're looking into it.

Edit: This should be resolved. Note that Facebook blocked those IPs because of malicious behavior. We'll keep working with them to prevent it again, but the best thing that you can honestly do is to use a hosting provider that provides a non-shared IP.

See here as well: https://developers.facebook.com/bugs/649166715098648

Answer 2

It appears Facebook have started blocking Heroku IPs for some reason. This isn't something that Heroku control, and only something that Facebook can resolve. I'd get in touch with Facebook support.