I discover something strange…
Concerning as3 graph api iframe embeding exemples from facebook-actionscript-api google code (wich are working fine) :

On firefox 3.6.12 and previous, the auto init (auto connect) is not working. The app will work outside of FB but not in the canvas.
But if you set a setTimeout (even with no delay) before the embed swf function….. it works !!

I know that doesn’t concern your own embeding solution but the facebook-actionscript-api one.

However, perhaps yours have the same kind of issue on on 3.6.12 and previous.

Thanks for all your help!

$app_uri = “http://apps.facebook.com/sambazon_warrior_up/”;
$auth_uri = “https://www.facebook.com/dialog/oauth”;
$client_id = “[my id]“;
$scope = “publish_stream,user_photos,user_photo_video_tags”;

$signed_request = $_POST["signed_request"];
list($encoded_sig, $payload) = explode(‘.’, $signed_request, 2);
$data = base64_decode(strtr($payload, ‘-_’, ‘+/’));

if(empty($signed_request)){
echo ( “window.top.location = ‘” . $auth_uri .
“?client_id=” . $client_id .
“&redirect_uri=” . urlencode($app_uri) .
“&scope=” . $scope .
“&response_type=token’;”);
}else{
echo “var signed_request=” . $data . “;”;
echo “generateFlash();”;
}

BTW: I am not able to create the signed_request var like your example. The initial var signed_request=; throws up an error in my JS console.

POST /fbapp/ HTTP/1.1
Host: sambazon.com
Referer: http://apps.facebook.com/sambazon_warrior_up/

signed_request=N7GgX95r…

asi you can see, there surely is post parameter available!

My client’s server accepts _POST vars because when I use FB’s technique:

<?php

$app_id = YOUR_APP_ID;
$app_secret = "YOUR_APP_SECRET";
$my_url = "YOUR_URL";

$code = $_REQUEST["code"];

if(empty($code)) {
$dialog_url = "http://www.facebook.com/dialog/oauth?client_id=&quot;
. $app_id . "&redirect_uri=" . urlencode($my_url);

echo(" top.location.href=’” . $dialog_url . “‘”);
}

$token_url = “https://graph.facebook.com/oauth/access_token?client_id=”
. $app_id . “&redirect_uri=” . urlencode($my_url) . “&client_secret=”
. $app_secret . “&code=” . $code;

$access_token = file_get_contents($token_url);

$graph_url = “https://graph.facebook.com/me?” . $access_token;

$user = json_decode(file_get_contents($graph_url));

echo(“Hello ” . $user->name);

?>

I am able to get $code, but unable to get file_get_contents($token_url); to work because (I’m assuming) the $token_url is secure.

However, when I use your technique I am never able to get $signed_request either with $_REQUEST["signed_request"] or $_POST["signed_request"]. So, I’m stuck with a looping app.

Also, I don’t understand how your post “neverending facebook changes…” applies to this. They seem like 2 different techniques.

I greatly appreciate any light you can shed on this.

Thx,
WL

http://apps.facebook.com/sambazon_warrior_up