Facebook iFrame App "This form has expired. Please refresh and try again."

Question

The secure URL that is called is: https://www.das-boot.com/facebook

But in facebook nothing is shown - only the following Expression Engine Error is thrown: "This form has expired. Please refresh and try again."

BUT there isn't any form or any other ee-tags within the called ee-template only plain html code!?

Anyone any idea? Going crazy with this...

Wow, this is a doozy of a question! it seems that when facebook requests a page into its iframe it comes in via a facebook page fetcher. It is this 'fetch' is a post style fetch (I believe facebook posts FB Auth info). therefor you'll need to look at (a) passing an csrf_toekn to facebook for passing back in its digest or (b) getting around the csrf_token check in EE. I'm sure someone with more EE/Facebook experiance will chime in with a proper answer before long! — Blatant, Commented Jun 10, 2015 at 14:00
Thanks for answering. I think I get an idea of what might be wrong - but still I really don't know how to solve anything :( Where to start from? Absolutely no idea... — amadeus, Commented Jun 16, 2015 at 5:47
Here's an idea, throw together a quick extension, Catch the Session Hooks, here you might be able to handle the Facebook post, perhpas check the digest and pop the FB details in the session, then clear the Post array. no post, no problem. The only thing is to find a hook before the security library loads so we can effect the post prior to it throwing a security wobbly. Other ideas are work out how to make FB pass an csrf_token value or header. — Blatant, Commented Jun 16, 2015 at 8:57

Denroy Robyn · Accepted Answer · 2016-02-22 14:26:38Z

1

For forms add a <input type="hidden" name="csrf_token" value="{csrf_token}"> or disable it in config.php

$config['disable_csrf_protection'] = 'y';

answered Feb 22, 2016 at 14:26

Denroy Robyn

822 bronze badges

Add a comment |

1 Answer 1