Why isn't the Facebook JavaScript SDK setting cookies?

Question

I'm having a problem where the Facebook JavaScript SDK isn't setting cookies on some machines, so my backend validation fails when trying to verify the cookie using my app's secret value.

I've got a demo app; the important files are:

• app.rb
• demo.js

The client uses the Facebook JavaScript API to log the user in and get their details, then posts these to my server. The server sends back the fbs_APPID which the client then displays. On some Windows machines (in all browsers) the server doesn't get the cookie it's expected. What's stopping Facebook from setting the cookie, and how do I go about fixing it?

The demo app is in Sinatra but our production app where we found the bug is Rails, if that makes a difference.

Answer 1

take a lookt at the initialization code for JS:

<script>
  FB.init({
    appId  : 'YOUR APP ID',
    status : true, // check login status
    cookie : true, // enable cookies to allow the server to access the session
    xfbml  : true  // parse XFBML
  });
</script>

Did you enable the cookie one in order to get cookie support? Make sure also that you don't have cookies disabled in your browser.

Answer 2

The cookie option sadly isn't that reliable ... personally i prefer to get a signed request of the javascript sdk , send this to the backend as a post var and then decode this signed request there to validate the call...

This way it will also work in safari :)

cheers!