mkdynamic/omniauth-facebook — Issue #33: facebook auth && secure cookies
Author: crankharder
Created: 2012-03-05 14:24:10+00:00
State: open

So I've run into a conflict with facebook and secure cookies. Here's some facts:

I'm currently using AuthLogic, with secure = true, which means the cookie is flagged secure and therefore is only transmitted over a secure connection.

If I enter https://www.mydomain.con (read: that's httpS) as my Site URL in facebook's app config, then I ultimately get an error about having an invalid redirect URL.

My Facebook authentication is therefore *not* SSL.... So here's what's happening:

1) User clicks my facebook link, which takes them over to FB where they authenticate
2) After successful authentication there they are rediected to the not SSL /auth/facebook/callback?blah=whatever
3) Everything is peachy inside this method, I do a find or create by user, and use AuthLogic's UserSession.create(user, true) to force them to log in.
-- If I debug out after that statement at the very end of this action there *is* a session - so AuthLogic has done its job.
4) The user then gets redirected back to root_url (also not SSL (but it doesn't really matter))
5) User is not logged in.
6) Frowny face.

I'm pretty sure the issue is the cookie' secure setting and the fact that /auth/facebook/callback isn't secure, so the client/server refuses to accept the new cookie since it's not a secure connection. Therefore, the next action has no cookie to use to retrive the perfectly valid and crated session,

It seems I cannot set my facebook site url to SSL, since FB throws an error on that ( not really sure why - it seems lame that they do this).

Even going always-on-ssl doesn't really solve this, since it seems that the facebook auth method must be non-ssl.

What's a FB hacker to do?