search

ccoenraets / OpenFB

Micro-library that lets you integrate browser and Cordova apps with Facebook with no plugin or SDK dependency.
MIT License
505 stars 231 forks source link

SECURITY WARNING #101

Open ngioldasis opened 8 years ago

ngioldasis commented 8 years ago

Hi, I'm using the openFB library in an ionic project. My settings are:

ionic version: 1.7.12 cordova-version: 6.0.0 openFB version: (latest commit)

when running the app in my browser, everything works fine.

In my Phone (android 5.0) there is a problem. When starting the app (on deviceready event), I do window.open = cordova.InAppBrowser.open

When I'm trying to login, the FB login page opens, I'm giving credentials, and click login.

The response is on a facebook page (https://www.facebook.com/connect/blank.html#_=_) saying:

Success

SECURITY WARNING: Please treat the URL above as you would your password and do not share it with anyone. See the Facebook Help Centre for more information.

and the FB login window never closes.

It seems that the openFB eventListener 'loginWindow_loadStartHandler' never fired.

Any ideas? Thanks in advance, Nektarios

ngioldasis commented 8 years ago

I finally resolved this issue.

The problem is on the InAppBrowser cordova plugin. InAppBrowser (version 1.2.0 which is available in the cordova registry at the moment of writing) does not fire the 'loadstart' and 'loadstop' event listeners in android platform (i don't know for IOS). So the opefFB handler which was registered on 'loadstart' was never fired up.

To solve this, install either the cordova-plugin-inappbrowser@~1.1.1 or install the latest version (1.2.1) directly from github (cordova plugin add https://github.com/apache/cordova-plugin-inappbrowser.git --save).

philip-sterne commented 8 years ago

Upgrading to 1.2.1 also fixed this issue for me too. Thanks!

sl45sms commented 8 years ago

+1 Thanks @ngioldasis

bogdanmartinescu commented 8 years ago

I have this problem only on iOS, in Android/iOS simulators all seems to be fine, but when using this on my iPad with the Ionic View this security warning appears. I've installed inappbrowser 1.2.1, but no change for me...

nicowenterodt commented 8 years ago

same here. @bogdanmartinescu are you using this lib within an cordova-app with WKWebView -Plugin?

I removed the setTimeout here https://github.com/ccoenraets/OpenFB/blob/master/openfb.js#L132 and called the close() method directly. that works. but that could cause other problems when recieving the auth_token very fast. (see comments L129 / L130)