Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork1.7k
Open
Description
Specifically for some POST requests in current implementation we get API calls from the server require an appsecret_proof argument response. Some POST endpoints will send the HTTP body with form encoded data, which would mean the body parameters are ignored.
Tangibly related it may be worth also implementing it followinghttps://developers.facebook.com/docs/facebook-login/security/#proof (using timestamp in proof computation is not enforced but recommended by FB)
// See https://developers.facebook.com/docs/facebook-login/security/#proof var appsecretTime = TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis()); final String appsecretProofPlain = accessToken + "|" + appsecretTime; for (byte b : mac.doFinal(appsecretProofPlain.getBytes())) { appsecretProof.format("%02x", b); } request.addQuerystringParameter("appsecret_proof", appsecretProof.toString()); request.addQuerystringParameter("appsecret_time", String.valueOf(appsecretTime));
Metadata
Metadata
Assignees
Labels
No labels