[Windows Mobile Software Development] meltwater:
Thanks guys for the support.

Spent another few hours searching the net for possible solutions and drawn a blank.

There appears to be a number of issues with this control, but no clear solutions, particularly for the new versions of windows mobile we have. Unfortunately I am out of my depth on this issue, since I don't know enough of the inner workings of .Net other than interfacing with the controls.

The facebook authorisation process, consists of sending a simple https call as follows:

https://graph.facebook.com/oauth/authorize?client_id=API_KEY&redirect_uri=http://www.facebook.com/connect/login_success.html&display=popup&scope=publish_stream,offline_access,read_stream

http://www.sociallipstick.com/wp-content/uploads/2010/05/web_server033.png

Where:

client_id is the id of the app.

redirect_uri is the standard acknowledge page for if you are not running your own server (it's more geared towards servers or apps within facebook).

display is the page type for the login page

scope is the permissions required

This is all fine, the url works fine from the browsers, even from a pc.

What should occur is, if you are not logged into facebook, it will ask you to accept the permissions and login (via facebook's own authorisation page). If you are logged in, it will ask you to confirm you want to allow access with those permissions, if you've already accepted permissions in the past it automatically returns the access code.

[This is the bit which isn't working]

Once that is done, facebook returns a url to the control, the url contains an access code (http://example.com?code=XXXX) which then you can exchange for an access token which is then used for all interactions with facebook on behalf of the app. This is done using a WebRequest control (able to perform HTTP_GET, HTTP_SET operations) which appears to work fine. The WebRequest control is used throughout the API for fetching and sending all the data (in this version just the user's status data).

NOTE: Also appears that you can not select different languages for the authorisation page, another great result from Facebook! Ok, it might do it from your ip, but don't think you can force it, not something I can test.

-------------------

Interestingly, I've just discovered there is a User Agent Flow version which skips the Access Code step and just returns the access token directly and is supposed to avoid the need store and use the application key used in the Access Code exchange (the facebook documentation mentioned the method for use with desktop apps, but doesn't highlight the difference so I hadn't noticed it). While, it still requires the WebBrowser control stage, it does mean you could obtain the Access_Token by just using the Client_Id (no application key required), which worries me, may mean I can't allow the Client_Id to be seen.

Unless I've got this wrong, it means if you can get hold of an apps Client_id you can generate an Authorisation_Token and pretend to be someone else's app with your own agenda...gotta love that one facebook...

Will test this tonight.

EDIT: Yep, you can pretend to be any APP you like...

---------------------------------------------------------------------

So, from the above you can see that the WebBrowser aspect is tiny, but without it, nothing is gonna happen (and the remaining fb API I have isn't much use either).

Humm, possible solutions:

Replace with alternative to WebBrowser control:

I've looked but can't seem to find anything suitable for .Net 3.5, older solution don't appear to work and I think it was kinda working for WM5 and then it was broken by WM6 and extra issues were added for WM6.5 and made worse by WM6.5.3. Tried OpenNetCF control, but the open version is quite old and as mentioned before, works ok in the emulator (WM6) but not on my device (with newer WM6.5.3). Still has issues protecting the url if required.

Update CF .Net 3.5 to include "fix":

Not sure if the fix will solve all the problems, might help with the scrolling problem/lack of panning etc, but no idea if it would help with the page not loading. However, if I can't seem to update my .Net package (or I've not been able to find the correct package) then I don't hold out much hope for getting the users to apply this without problems. Plus, bit of an overkill in my opinion to force updates for such a small part of the software.

If releasing the app client_id isn't an issue:

Perhaps it might be possible to allow the user to enter the intermediate access code directly into the settings page, I would then be able to use that code to get the access_token and we would be back in business. Would even be able to open the default browser using the required url, so simple cut&paste job?

Find someone who knows more about WebBrowser control to tell me what the solution is:

Wishful thinking I guess, but can't be the only person to have these issues.

New idea...if once the app has the required authorisation permissions applied and the user remains logged in, then the browser control does not need to generate any login page or request the permissions again from the user. Would have to see what happens on the problem devices though. Again requires exposing the client_id, but would not need cut&paste...

So the solution could be, to open the authorisation via the default browser, allow them to login and grant permissions and then re-request the access_code afterwards without bothering the user directly from the app.

I will investigate the HTC Sense facebook application and my HTC FbTab a little closer, if it is easy to find the client_id anyway then should be no problem with allowing it to be seen during authorisation. Unfortunately I can't do that from here, so will have to wait on that.

---------------------------

Q1: Out of interest, how many have authorised correctly and posted status updates?

Also was the language correct on the authorisation page?

Q2: Another question...is anyone else having issues with the links to "Friend Requests", "Messages" and "Event Invites" from the sense subpage.

1 unread message

1 friend invite

1 unread event invite

You will notice that they always link to the mobile site (this is because they are fixed values in the sense code - unfortunately within a luac script with decompile issues). However I've noticed that some don't appear to jump to the correct places anymore - used to link directly to the correct section of the mobile page.

Q3: Finally, the default I've specified for the Desktop link for "Facebook Online" ends up defaulting back to the mobile site (at least for me - might be browser setting dependent on if facebook detects mobile a browser). Everyone else get this?

Solution is:

Instead of "www.facebook.com/" you should use "www.facebook.com/home.php?m2w". I would like everyone to confirm if they have the problem and if the different url works for all.

------------------

Oh also I finally had an event from someone on my contact list so I can confirm the LeadTimeOfEventsEnable works fine, so that will be included. Also LeadTimeOfEvents works fine too so will add that as well.

------------------

That's all for now.