9

I'm using facebook php sdk 3.1.1 and the current version of the facebook JS sdk. Our users are not reporting errors, but I'm seeing a ton of error log messages like this:

Unknown algorithm. Expected HMAC-SHA256

I see from the source that the error is triggered when reading a signed request with the wrong encoding encoding algorithm, but I'm not sure why that would be, as all signed requests should be generated by the facebook JS code.

Anyone seen this behavior? Any idea how bad a thing this is, or whether it's really indicative of errors? I have been unable to replicate it on demand.

mike
  • 213
  • 3
  • 6
  • 1
    Could there be some other source of POST requests to your page that you're running through the same code that you use for decoding the signed_request? – Igy Sep 01 '11 at 04:58
  • I guess that could conceivably be happening, but from looking at the code, the parseSignedRequest() call is passed either $_REQUEST['signed_request'] or $_COOKIE[$this->getSignedRequestCookieName()]). It seems unlikely that either of these are being populated by anything other than the javascript sdk. There is nowhere in our code that references 'signed_request' other than in the php sdk. – mike Sep 02 '11 at 17:35
  • I am starting to see the same stuff in my error logs. I don't understand how this error could happen. The only way the user can get to the page that has the $_REQUEST['signed_request'] is after the user clicks "Register" via the facebook button. Therefore the required information should be populated already. – brant Sep 07 '11 at 23:56
  • I am seeing this all the time. Some small percentage of my users are getting the error consistently. I don't know what that percentage is. The problem seems to be that the cookies aren't being set before the request goes to the server, resulting in failure to authenticate. The symptom is that it claims the algorithm is unknown, but in fact the algorithm hasn't been sent. I'm betting that if you check cookie values and $_REQUEST['signed_request'] they will be empty. I've tried working around it by manually setting $_REQUEST['signed_request'] in my AJAX calls, but that hasn't worked so far. – Garth Oct 21 '11 at 05:40
  • By the way, for me this happens only on AJAX calls using jquery. Is it the same in your case? – Garth Oct 21 '11 at 05:44
  • Did you ever manage to solve this? I'm getting this same error message in the logs, and have been logging the signed request, but it's empty so far. My thinking is that it's trying to get the value from the cookie and for some reason it's empty or not present. – Favio Oct 30 '12 at 11:03

4 Answers4

3

Try logging some of the signed_request parameters to inspect them manually. For instance, you could change the log line in Base_Facebook::parseSignedRequest to this:

  self::errorLog('Unknown algorithm. Expected HMAC-SHA256, request='.$signed_request);

Once you have a few of these logged, decode them manually or paste them at the end of this URL:

https://developers.facebook.com/tools/echo?signed_request=

Check what algorithm is specified in the payload or whether the data is malformed in some way. If you share the results here, make sure to omit private data like the access token value.

You might also want to check your web server access logs. For starters, look for GET requests with a signed_request query parameter that occurred around the same time as those entries in your error logs.

PCheese
  • 3,231
  • 28
  • 18
0

I looked through my logs and found what I believe to be the problem. I found that there isn't an exact correlation regarding the timestamp, but there is a close enough correlation between this log entry in the syslog and a logged request which uses a bing referer.

The bing referer has a handful of telltale signs of being related:

1) Url: http://www.bing.com/fbf/search
2) Query string components:
2a) form=FBKBFT
2b) pc=FACEBK
2c) signed_request=

Going to http://www.bing.com/fbf/search loads up what appears to be the facebook bing searcher. If you go to facebook and use the search at the top to look for anything, then go to Web Results, you'll see it uses bing as well.

I believe that bing's facebook integration is somehow passing some sort of invalid data in the signed_request query string. Unfortunately, I'm just the sysadmin and the server I'm seeing this on is one of my customers. One that doesn't care about the error. I've filtered it using syslog-ng to a separate log file, along with a whole slew of other errors coming from php facebook stuff.

Speeddymon
  • 496
  • 2
  • 20
0

Perhaps use the v3.1.1 of the SDK? https://github.com/facebook/php-sdk

olleolleolle
  • 1,918
  • 16
  • 20
  • He mentioned he is already using version 3.1.1 of the PHP SDK (may have been edited after your comment). – PCheese Sep 08 '11 at 20:43
0

Propably you're doing get/post request to the same page where youre creating Facebook object. So there's no any parameter signed_request for your request and Facebook class returning this error for You :)

Maybe Google or other search engines making request to your site using their crawlers? Thats possibility too.

I hope this answer will be helpful for You.

kkszysiu
  • 537
  • 2
  • 8