1

I order to get access to the Facebook API on behalf of a user, one must get an OAuth access_token, the process is well documented (albeit it appears to be some undocumented requirements from FB) but from time to time I get this "Error validating verification code." when trying to exchange a validation code for an access_token.

There seems to be a lot of people having such trouble and most of the time the redirect_uri seems to be the issue, but here the redirect_uri is fine (it's exactly the same as the one passed to the auth dialog, ends with a slash and do not have funky characters or a trailing query string, I read almost all threads on SO about this issue and none of the proposed solutions did solve my problem)

What is the most intriguing is that when I check my logs, where I write the exact request url I use, and manually try it to get the access token, then it works. It is like the request is failing when the user logs in but works after some time.

So the fact that it is working after all seems to indicate that the request is fine but there is a problem on the Facebook side, like if there was some replication involved that did not complete between the time the auth dialog do it's thing and I try to exchange the code for a token.

I put in place a retry mechanism, hoping that the delay between two calls would be enough and the second call would succeed, but it doesn't work either.

Also, it's working most of the time and I cannot tell any difference between when it works and when it fails, only the user changes.

Any suggestion would be greatly appreciated.

Claude Vedovini
  • 2,421
  • 21
  • 19
  • FYI, it'd be easier to understand your question if you mentioned upfront that you're talking about the Facebook API. – Nick Johnson Apr 11 '12 at 03:33
  • Nick, you're right, and I also can tell I get you out of the woods because of the gae tag when it does not apply here (although it's running on gae) – Claude Vedovini Apr 11 '12 at 06:45
  • If you're embedding into a facebook page, then I've found the signed request route a much easier way to get the oauth token. However if you're off facebook (like the old facebook connect) then you're stuck with this method - which you can get working, but is a little finicky. – Michael Anderson Apr 11 '12 at 07:09
  • that's a good point actually, I always wondered of what use was that token exchange since I got it in the signed_request but wanted to stick to the docs. This actually wouldn't solve the issue but would work around it for sure. – Claude Vedovini Apr 11 '12 at 07:17

1 Answers1

0

I just bumped into this issue and solved it.

The issue was that I specified the redirect_uri in the oauth call to be http://apps.facebook.com/myapp/ instead of https://apps.facebook.com/myapp/ .

One thing that was kind of odd is that the exact same parameters worked if I entered them into the browser address field, but not as a server side request from the application.

It is possible on a per user basis to specify if you want to browse Facebook with or without HTTPS, so I recommend that you test with the setting at both modes when you test your authentication flow.

Robin Andersson
  • 5,150
  • 3
  • 25
  • 44