FB API requiring https

[braunm]

Hi. This is my very first attempt at using the Facebook API, so I apologize in advance if this is an overly basic question. I am trying to get a token, and I have set up my app and account according the instructions on fbRads homepage. When I run the following code:

app <- oauth_app('facebook', <ID>, <Secret>) tkn <- oauth2.0_token( oauth_endpoints('facebook'), app, scope = 'business_management', type = 'application/x-www-form-urlencoded', cache = FALSE) My browser launches, and I get the following message on a FB page:

Insecure Login Blocked: You can't get an access token or log in to this app from an insecure page. Try re-loading the page as https://

In the R console, I get:

oauth2.0_access_token(endpoint, app, code = code, user_params = user_params, : Bad Request (HTTP 400). Failed to get an access token.

A little bit of research led me to https://developers.facebook.com/docs/facebook-login/security/#surfacearea , where I find this piece of information:

Enforce HTTPS for OAuth Redirects and SDK APIs. This setting requires HTTPS for OAuth Redirects and pages getting access tokens with the JavaScript SDK. All new apps created as of March 2018 have this setting on by default and you should plan to migrate any existing apps to use only HTTPS URLs by March 2019. Most major cloud application hosts provide free and automatic configuration of TLS certificates for your applications. If you self-host your app or your hosting service doesn't offer HTTPS by default, you can obtain a free certificate for your domain(s) from Let's Encrypt."

Not being a "real" developer, I'm not quite sure what to do next, and would greatly appreciate some guidance. Is there an argument in fbRads that I can set to allow https access?

Context: Mac, using Safari. R 3.4.3, http 1.3.1

Thanks.

[peeyooshc]

This happened to me before. You need to upgrade your version of httr, and make sure your app config on FB allows FB login.

[braunm]

I am now running httr 1.3.1. I have both the Marketing API and Facebook login in my app. Is there something else I need to check?

[daroczig]

It seems that the "Enforce HTTPS" checkbox is enabled by default as per the above quote from https://developers.facebook.com/docs/facebook-login/security -- so I'd suggest disabling that in the FB settings and retry.

[braunm]

It does not appear that I can uncheck the Enforce HTTPS checkbox, as it is grayed out. In any case, is there a way to use HTTPS to maintain the additional security?

[daroczig]

In that case, check the upstream eg at r-lib/httr#510 on how to use OAuth2.0 requiring HTTPS

[braunm]

Thanks. That httr issue is exactly the same problem I have. I'll look for a solution there, but any other suggestions regarding configuration would be welcome.

[3642066]

That sucks. I remember pages had 520px and they lauched FQL, so i had code ready for use on 520px they jjust changed the page tab compleatly to 820px, then, require HTTPS for all apps and games, then depracted FQL, i had spent a lot of time coding got all resources ready to use, then its depracated too. That sucks .

[daroczig]

See also #96 -- I've updated the README.md on how to generate a token without going through this painful process.

[3642066]

"Enforce HTTPS" checkbox

The "Enforce HTTPS" checkbox is avaiable only for old apps, for a limited time . I had updated everything last month, logins running ok, so they changed everything again . For profile images, need token, and also changed the variables . I am seriously thinking on using only other services, and maybe ill have many problems because users going to lost accounts created using Facebook, they dont have a login and a pass..some emails are missing, and the problem is that , if i update and fix eveything, they are going to change everything again .. i cant stay loosing my time on Facebok Platform because of monthly deprecations . i used to have projects abobut all that. Many apps, doing things for the user experience .. THis one i made for moderating groups .. it could list and exclude posts, also coments, in a custom interface, so i could exclude posts and spammy comments in one click .