Where to find the Facebook cookie?

Question

I'm kinda new to this so bear with me. I've installed a "Login with Facebook" button via the Javascript SDK, which works fine. I've also set up the PHP code (facebook.php) I can login successfully to Facebook via javascript but then can't access the UID from the session via php. So, how can I get php to access the session javascript sets? thanks

Edit: (Posting code from below here so it'll be easier to read)

I can console log the response and see it.

FB.getLoginStatus(function(response) {
    console.log(response.session.uid);
});

Refresh the page, and try to access the session that was set via php, it comes up null.

require_once(RELATIVE_PATH.'applibs/facebook.php');
$config = array('appId'=>Config::$fb_app_id, 'secret'=>Config::$fb_secret, 'cookie'=>true);
$fb = new Facebook($config);
$fb->getUser(); // this will equal null because the $fb object isnt finding the cookie supposedly set by javascript

* Did some debugging in the facebook.php

on line 358... $cookieName = $this->getSessionCookieName();
// retuns fbs_myNumericAppId, seems like that worked..
if (isset($_COOKIE[$cookieName])) {
// FAILS! there is no $_COOKIE['fbs_myNumericAppId']

That seems logical as how could logging into facebook.com know what my app ID is?
I also noticed after logging into facebook.com, there's NOTHING facebook related in $_COOKIE. So, in order to log into facebook via facebook.com, then have a website notice that login, you have to run FB.login on a page load. Then you have to set a cookie via the javacript info returned into $_COOKIE so the php can pick it up anywhere else.

Solution

I happen to have a blog post and some previous answers that may be of use to you as reference points.

Have you registered your site on Facebook as an "application"? If not, you'll need to do that. The cookie which Facebook sets that allows your site to access a user's information (once they've agreed to give your "application" access) uses a combination of your application's ID and "secret" (a long alphanumeric string that you must not share, or other applications would be able to impersonate yours) to set an encrypted value with the user's ID and an authentication token unique to the user and your application (representing the permission they've given you to their data).

The cookie is posted to your site alongside requests like any other cookie. You'd use your application's secret to decrypt it and extract the user's ID and authentication token, which you would then use to access data via Facebook's graph API.

Comments

[hogsolo]

Yes I've registered the app. I can see the response.session coming in when I login via javascript, but not with php

[David]

@hogsolo: Can you post some code with what you're trying to do?

[David]

@hogsolo: That's fine. Just make sure you obfuscate anything compromising in any code that you post (such as the application secret). There are a number of different ways to interact with Facebook, even just via JavaScript, so it'll be a lot easier to help with a baseline of code that can reproduce the issue.

[hogsolo]

I'm logging into facebook via the javascriptSDK version. <br />I can console log the response and see it. FB.getLoginStatus(function(response) { console.log(response.session.uid);}); Refresh the page, and try to access the session that was set via php, it comes up null. require_once(RELATIVE_PATH.'applibs/facebook.php'); $config = array('appId'=>Config::$fb_app_id, 'secret'=>Config::$fb_secret, 'cookie'=>true); $fb = new Facebook($config); $fb->getUser(); // this will equal null because the $fb object isnt finding the cookie supposedly set by javascript

[David]

@hogsolo: Is the facebook.php a standard library that you downloaded? Can you link to it? I'm not familiar with it. Do you also need to run FB.init() in the JavaScript? (Or did you just omit that for brevity?)

[hogsolo]

facebook.php is Facebook's official SDK, available on github.com/facebook/php-sdk. yes I left out the FB.init() for brevity... Let me ask this another way... If I'm logged into Facebook via Facebook.com and assuming a cookie is set when I do, what PHP code can I use to detect that cookie, retrieve the token, uid and other information and then use that to access facebook's API from my website?

[David]

@hogsolo: Hmm. At this point I'm mostly guessing, but it's worth a shot I suppose. Have you tried also setting the domain in the constructor parameters? It's optional, but might be worth setting. Can you debug into the getSession() function in the API and see more specifically where it's failing? That seems to be the bulk of the logic. Does it get as far as accessing the $_COOKIE array or fail before that? If it gets to it, what's in the array?