Sessionless requests are not possible (both in 4.0.* and master)

[dcelasun]

This thing bit me today. I have a user id and an associated access token and I want to get that user's currency information. Normally, the request looks like this:

https://graph.facebook.com/<some version>/<user id>?field=currency&access_token=<access token>

This is a perfectly valid request and yet, the SDK has no way of actually executing it since FacebookRequest requires a FacebookSession as its first parameter and there is no session.

Am I missing something? If not, can you please fix this (both for 4.0.* and master)?

[SammyK]

FacebookSession ≠ $_SESSION. Think of it as an access token. That ambiguity is one of the reasons it's being deprecated in 4.1.

If you already have an existing access token you can do this:

$session = new FacebookSession('access-token');
$response = (new FacebookRequest($session, 'GET', '/{user-id}?field=currency'))->execute();

If you want to set a specific version of Graph, that's the 5th param to FacebookRequest.

$response = (new FacebookRequest($session, 'GET', '/me', null, 'v2.1'))->execute();

[dcelasun]

Your example doesn't work as it throws an FacebookSDKException with:

You must provide or set a default application secret.

I shouldn't need an application secret for this query.

[SammyK]

It needs to the app secret to calculate the app secret proof which is enabled by default.

[dcelasun]

EDIT: Disabling proof calculation does allow me to run arbitrary queries. Thanks! Still, there is a minor issue:

$useAppSecretProof is defined as private static. As I have to extend FacebookSession to avoid the session_* functions fix #190, I have to call enableAppSecretProof from a child class which is not possible. Making it protected should fix it.

Thanks for the help :)

[SammyK]

FacebookSession doesn't make calls to session_* functions. FacebookRedirectLoginHelper is the only class that touches the PHP session stuff.

enableAppSecretProof() is a public method.

// Disable app secret proof
FacebookSession::enableAppSecretProof(false);

// Make calls to Graph (without app secret proof)

[dcelasun]

Yeah, sorry I got it confused with FacebookRedirectLoginHelper. I need to override FacebookSession so I can fix #190 until the PR gets merged.

enableAppSecretProof() is a public method.

It's a public method that modifies a private static property, so you can't call it if you extend the class. So $useAppSecretProof should be protected, not private.

[gfosco]

Closing this since 190/191 were closed. Let me know if this doesn't take care of it.

[dcelasun]

@gfosco This is unrelated to #190/#191 as, for whatever reason, one wishes to extend FacebookSession, calling enableAppSecretProof() becomes impossible. This can only be fixed by making $useAppSecretProof protected, instead of private.

[gfosco]

Ok, sent in #196 and #197 to change this in both master and 4.0-dev.

[dcelasun]

Wow, you are fast! Thanks!