Django facebook app: missing signed_request

Question

Inspired by the write a facebook app app in 20 minutes on Hacker News, I'm writing a facebook app, and the home page works fine: The empty list of poems is displayed. However, I'm having trouble creating a link from one view to another.

I'm using django, here's some code:

from urls.py

urlpatterns = patterns('',
    url(r'^$', 'crosswords.ugly.views.home', name='home'),
    url(r'^create/$', 'crosswords.ugly.views.create', name='create'),

From views.py:

@canvas_only
def create(request):
    if request.method == 'GET':
        return render(request, 'create.html', {
            'form': PoemEntryForm(request.GET)
        })

From: templates: home.html

<p>Would you like to create a <a href="/create/">new poem</a>?</p>

Please let me know if there are any specific files I can post to shine light on the problem, and I'll do so. I tried various variations of /create/, /create, and even create/ in urls.py and the link in home.html.

The problem is that I keep getting this message:

400 Bad Request

Missing signed_request.

when trying to click on the link in home.html. Any help from seasoned django, facebook or -developers would appreciated.

glad someone's found it worth-while! Here's a link to the original guide, for anyone interested http://blog.pythonanywhere.com/35/ — hwjp, Sep 02 '12 at 19:19

score 2 · Answer 1 · answered Sep 01 '12 at 01:22

2

I found the answer to the question:

The problem was that I wasn't using <a href="site{% url url_name %}">... as defined in urls.py. In this case, <a href="site{% url create %}">... worked wonders :)

answered Sep 01 '12 at 01:22

lowerkey

8,105
17
68
102

score 0 · Answer 2 · edited May 23 '17 at 12:21

After having spent several hours trying to figure out why a simple link on my app page would bring up the dreaded message "400 Bad Request - Missing signed_request." I came across this post and I finally began solving the riddle.

Slow load facebook canvas app when click on links (if target top)

In brief: YOU DO NOT NEED to use any decorator (e.g. @canvas_only or @facebook_required) on your view. Instead, as suggested, save the info in the session the very first time you get hold of that information (say FB user id and name). I do it in my homepage (the only view decorated with @canvas_only). Nota Bene: in order to be able to store something in the session, you need to enable it in your settings.py: it should be OK in the MIDDLEWARE section already, but also add it in the INSTALLED_APPS by uncommenting the entry 'django.contrib.sessions'.
Now perform a syncdb (python manage.py syncdb) to make sure the relevant tables are created (I assume the session is stored in the db). If you need it for further calls to the FB API, also store the access_token in the session (request.session ['signed_request'] = access_token)

What really causes the problem though, is redirecting to a page at the end of the view, for ex. with redirect() or with HttpResponseRedirect(). That triggers a GET request and not a POST.
Oh btw, did I mention all the GET requests become POSTS? HAHAHAH it gets confusing hey? Furthermore, there are some serious security implications to be considered.

I have just started playing with this stuff myself, so please do take the present info as hints and clues and not as commandments.

Django facebook app: missing signed_request

2 Answers2