0

After a login is completed using Facebook AccountKit, I want to retrieve the phone number or email used to authenticate. According to the docs this is a simple method call in the SDK:

[accountKit requestAccount:^(id<AKFAccount> account, NSError *error) {...}];

However, I keep getting this error:

[AccountKit][Error]: API calls from the server require an appsecret_proof argument

Okay, first of all I am making the call using their Client SDK not from the server so the error text makes no sense. And the user just logged in so I have a valid access token.

Even assuming calls from the client required appsecret_proof as a parameter, there is no field for parameters when calling requestAccount.

I want all calls from the server to provide App Secret for security purposes, so I would rather not turn that setting off for my app. So how do I call requestAccount from the client when Require App Secret for server API calls is on?

Joel
  • 15,654
  • 5
  • 37
  • 60

1 Answers1

0

I don't think it makes sense to have your server calls to FB secured with a secret, but have your client side requests not secured. Remember that your client side is way more susceptible to hacking than your server would ever be.

Since you're already making server-to-server calls to AK with the secret, I suggest you just add a new call from your server side that fetches the account info and passes it back down to your client.

For extra security, turn off client token flow entirely and only use code flow

Pouya Larjani
  • 408
  • 3
  • 8
  • That all makes sense, except my client just passed the email from the client to the FB server to create the auth. Weird that I can pass it down but can't get it back. I would think AccessKit could keep that info locally and provide it without an insecure call to the server. I've refactored everything to use code and get the info from the server now. – Joel Oct 05 '17 at 17:18
  • Also the error message should say something like API calls from the client SDK not allowed when appsecret_proof is required. Since the client doesn't even support adding appsecret_proof as a parameter. – Joel Oct 05 '17 at 17:21