Facebook SDK returned an error: Cross-site request forgery validation failed. The “state” param from the URL and session do not match

by

I found that as long as I enabled PHP sessions before generating the login url, and at the top of the script Facebook eventually redirects to, it works just fine on its own without setting a cookie (as per ale500’s answer). This is using the 5.1 version of the sdk.

At the top of both scripts, I added…

if(!session_id()) {
    session_start();
}

…and it “just worked”.

Here’s a barebones complete example that worked for me:

auth.php

if (!session_id()) {
    session_start();
}

$oFB = new Facebook\Facebook([
    'app_id'     => FACEBOOK_APP_ID,
    'app_secret' => FACEBOOK_APP_SECRET
]);

$oHelper = self::$oFB->getRedirectLoginHelper();
$sURL = $oHelper->getLoginUrl(FACEBOOK_AUTH_CALLBACK, FACEBOOK_PERMISSIONS);

// Redirect or show link to user.

auth_callback.php

if (!session_id()) {
    session_start();
}

$oFB = new Facebook\Facebook([
    'app_id'     => FACEBOOK_APP_ID,
    'app_secret' => FACEBOOK_APP_SECRET
]);

$oHelper = self::$oFB->getRedirectLoginHelper();
$oAccessToken = $oHelper->getAccessToken();
if ($oAccessToken !== null) {
    $oResponse = self::$oFB->get('/me?fields=id,name,email', $oAccessToken);
    print_r($oResponse->getGraphUser());
}

Why?

As an additional note, this is explained in the Docs on the repo. Look at the warning on this page.

Warning: The FacebookRedirectLoginHelper makes use of sessions to store a CSRF value. You need to make sure you have sessions enabled before invoking the getLoginUrl() method. This is usually done automatically in most web frameworks, but if you’re not using a web framework you can add session_start(); to the top of your login.php & login-callback.php scripts. You can overwrite the default session handling – see extensibility points below.

I’m adding this note because it’s important to keep in mind should you happen to be running your own session management or if you’re running multiple web servers in parallel. In those cases, relying upon php’s default session methods won’t always work.

More Related Contents:

  1. Facebook messenger bot Webhook not working [closed]
  2. Is it possible to get friend’s emails using facebook api?
  3. facebook graph api not work from 2.2 to 2.3
  4. Why is Facebook PHP SDK getUser always returning 0?
  5. Simple example to post to a Facebook fan page via PHP?
  6. Facebook Graph API, how to get users email?
  7. Facebook only returning name and id of user
  8. how send message facebook friend through graph api using Accessstoken
  9. How do I can post a multiple photos via Facebook API
  10. Post to a Facebook user’s wall with cURL PHP
  11. Publishing To User’s Wall Without Being Online/Logged-in – Facebook Sharing Using Graph API
  12. Redirecting to authentication dialog – “An error occurred. Please try again later”
  13. Post to a facebook page without “manage_pages” permission using php
  14. WordPress doesnt show full page
  15. My Link won’t work after custom post delete (wordpress) [closed]
  16. How to improve page load performance of the WordPress website?
  17. Warning: preg_replace(): Unknown modifier
  18. What’s the net::ERR_HTTP2_PROTOCOL_ERROR about?
  19. Reordering checkout fields in WooCommerce 3
  20. query_posts() should be avoided?
  21. Php – Your PHP installation appears to be missing the MySQL extension which is required by WordPress
  22. Proper URL forming with a query string and an anchor hashtag
  23. WooCommerce: Check if items are already in cart
  24. Updating product stock programmatically in Woocommerce 3
  25. wordpress plugin -> Call to undefined function wp_get_current_user()
  26. Get refunded orders and refunded order items details in Woocommerce 3
  27. Get the metadata of an order item in woocommerce 3
  28. Add a quantity field to Ajax add to cart button on WooCommerce shop page
  29. Add a fee to an order programmatically in Woocommerce 3
  30. Replace woocommerce_add_order_item_meta hook in Woocommerce 3.4

Leave a Comment