带有通配符 OAuth 重定向 URL 的 Facebook 应用 [英] Facebook App with wildcard OAuth redirect URL

问题描述

我有一个正在开发的 Facebook 应用.在我的应用程序的高级设置选项卡(在 Facebook 的开发者网站中)中，我想指定一个带有通配符的 OAuth 重定向 URL.

I have a Facebook app that I'm working on. In my app's advanced settings tab (in Facebook's developer site) I'd like to specify an OAuth redirect URL with a wildcard in it.

我的应用程序的每个用户都有一个自定义子域(例如 foobar.example.com).我希望能够指定一个 OAuth 重定向 URL，例如 *.example.com.

Each user of my app has a custom subdomain (e.g. foobar.example.com). I want to be able to specify an OAuth redirect url such as *.example.com.

我知道对于 Twitter 和 LinkedIn 等其他平台，可以通过将重定向 URL 简单地设置为 example.com 来实现这一点，并且它将接受带有任何子域的重定向 URL，包括 www.在我的应用程序的常规设置选项卡中，我能够将 url 从 app.example.com 更改为 example.com.这样做之后，我仍然可以从 app.example.com 进行身份验证，并且我被重定向回 app.example.com/callback 因为 app.example.com/callback 在我的应用设置中被列入白名单.

I know for other platforms such as Twitter and LinkedIn, it's possible to achieve this by setting the redirect URL simply to example.com, and it will accept redirect URLs with any subdomain, including www. In my app's general settings tab I was able to change the url from app.example.com to example.com. After doing that, I can still authenticate from app.example.com and I am redirected back to app.example.com/callback because app.example.com/callback is whitelisted in my app settings.

如果我尝试从另一个子域(例如 foobar.example.com)进行身份验证，之后我将被重定向回 app.example.com/callback，即不是我想要的.我尝试将重定向 URL 更改为 example.com，就像我对站点 url 所做的那样，但随后我重定向到了 example.com/callback 而不是 app.example.com/callback.

If I try to authenticate from another subdomain such as foobar.example.com, I'm redirected back to app.example.com/callback afterwards, which is not what I want. I tried changing my redirect URL to example.com, as I did with the site url, but then I am redirect to example.com/callback instead of app.example.com/callback.

我也尝试过使用通配符，例如 *.example.com/callback，但 Facebook 不允许我在 URL 中使用通配符保存设置.

I've also tried using a wildcard such as *.example.com/callback, but Facebook wouldn't let me save the settings with a wildcard in the URL.

如何使重定向 URL 动态化，以便我无需手动输入数百甚至数千个列入白名单的 URL?

How can I make my redirect URL dynamic so that I don't need to manually enter hundreds or even thousands of whitelisted URLs?

推荐答案

以下是通过 4 个简单步骤完成此操作的方法:

Here's how to accomplish this in 4 simple steps:

1. 为您的应用创建一个新的子域(例如 auth.example.com).
2. 在您指定有效 OAuth 重定向 URI 的 Facebook 应用的设置选项卡中，使用正确的 Oauth 控制器路径(例如 https://auth.example.com/auth/facebook/callback).
3. 当用户想要授权您的应用时，将他们照常发送到 Facebook，并使用他们的用户 ID(或某些其他标识符)作为参数指定您的新重定向网址(例如 https://auth.example.com/auth/facebook/callback?user_id=123).
4. 当用户点击您服务器上的重定向 URI 时，保存他们的访问令牌，然后将它们重定向到您想要的任何位置(例如返回到 https://foo.example.com).

1. Create a new subdomain for your app (e.g. auth.example.com).
2. In the settings tab for your Facebook app where you specify the Valid OAuth Redirect URIs, put in your new subdomain with the right path to your Oauth controller (e.g. https://auth.example.com/auth/facebook/callback).
3. When the user wants to authorize your app, send them to Facebook as normal and specify your new redirect url with their user ID (or some other identifier) as a parameter (e.g. https://auth.example.com/auth/facebook/callback?user_id=123).
4. When the user hits that redirect URI on your server, save their access token and then redirect them to wherever you want (e.g. back to https://foo.example.com).

我的应用已成功使用这种精确设置近两年，我们每天为数千名用户提供服务.

My app has used this exact setup successfully for almost two years and we service thousands of users a day.

这篇关于带有通配符 OAuth 重定向 URL 的 Facebook 应用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！