Facebook JavaScript SDK over HTTPS loading non-secure items

by

TL;DR

set FB._https to true before calling FB.init. Like so:

FB._https = true;
FB.init({
    /* your app id and stuff */
});

Explanation

If you unminify the Facebook JavaScript SDK, you’ll see that its basically an object literal with a bunch of properties. One of these properties is _https, which is a boolean. This property determines which set of URLs to use (stored in FB._domain) when making API requests. It seems as though Facebook keeps two sets of URLs for each type of API request — a secure URL and and non-secure URL — then uses a switch function called getDomain() to determine which to use when making requests.

The reason the JavaScript SDK causes security warnings is due to the way the FB._https property is defined. This is how it’s currently defined as of 2011-8-24:

_https: (window.name.indexOf('_fb_https') > -1)

Apparently Facebook thinks that if the window.name property has _fb_https in it, then it must be a secure app. This is obviously incorrect. The real test should be something similar to this:

_https: window.location.protocol == "https:"

Unfortunately, the SDK is not open source or even well documented, so I can’t submit a pull request for this change :P. In the short term, setting FB._https to true manually before calling FB.init should do the trick.

More Related Contents:

  1. Facebook API error 191
  2. How to get access token from FB.login method in javascript SDK
  3. why doesn’t java send the client certificate during SSL handshake?
  4. Creating and managing a Facebook app from a Business Account [closed]
  5. How do I allow HTTPS for Apache on localhost?
  6. Facebook Open Graph not clearing cache
  7. Facebook API: Get fans of / people who like a page
  8. ‘Like’ a page using Facebook Graph API
  9. How to Test Facebook Connect Locally
  10. Session lost when switching from HTTP to HTTPS in PHP
  11. Python requests.exceptions.SSLError: EOF occurred in violation of protocol
  12. How to link a Facebook app with an existing fan page
  13. How to force java server to accept only tls 1.2 and reject tls 1.0 and tls 1.1 connections
  14. Android volley self signed HTTPS trust anchor for certification path not found
  15. Java and HTTPS url connection without downloading certificate
  16. trying to get app access token
  17. How to trigger Facebook like button from custom button?
  18. Facebook graph user picture won’t show on mobile devices
  19. Python getting common name from URL using ssl.getpeercert()
  20. How to list facebook users who like a page or interest [duplicate]
  21. Get public page statuses using Facebook Graph API without Access Token
  22. HTTPS with NSURLConnection – NSURLErrorServerCertificateUntrusted
  23. Get facebook friends with Graph API v.2.0 [duplicate]
  24. Facebook share button and custom text [closed]
  25. Enabling SSL with XAMPP
  26. Issues with installing python libraries on Windows : CondaHTTPError: HTTP 000 CONNECTION FAILED for url
  27. Facebook ignoring OG image on first share
  28. How to add facebook share button on my website?
  29. Get application id from user access token (or verify the source application for a token)
  30. Enabling SSL on tomcat using pem file

Leave a Comment