Question

我在为我的应用验证用户时遇到了一些麻烦。在身份验证过程中，我收到以下错误：

Refused to display 'https://www.facebook.com/dialog/oauth?response_type=code&client_id=xxxxxxxx…%2Fliketodownload.xx-xxxx.com%2Fauth%2Ffacebook%2Fcallback&scope=email' in a frame because it set 'X-Frame-Options' to 'DENY'.

我认为这与尝试重定向到无效目标的身份验证有关，这就是它被阻止的原因。但是对于Ruby和Sinatra，我不确定如何克服这个问题。

非常感谢。

更新

我没有重定向到视图，其中auth和添加到页面对话框通过html触发到新目标。现在，我正在试图找出适当授权和重定向用户的逻辑。

以下代码：

  post '/' do
  if current_user
      signed_request = FBGraph::Canvas.parse_signed_request(APP_SECRET, params[:signed_request])
      if signed_request["page"] != nil
        is_admin = signed_request["page"]["admin"]
        is_liked = signed_request["page"]["liked"]
        if is_admin #if admin, see if existing user is in db, if not create, then send to admin page
          puts "user is a page admin" #logging for dev
          redirect '/index'
        elsif is_liked #if liked send to download end point
          puts "user has liked page" #logging for dev purposes
          redirect '/main/#/liked'
        elsif !is_liked #otherwise make them like the page
          puts "user has not liked" #logging for dev purposes
          redirect '/main/#/notliked'
        end
      else
        redirect '/addtopage/#/addtopageview'
      end
  elsif $auth1 && !current_user
    puts "post / add to page view reached"
    User.first_or_create({:uid => $auth1["uid"]}, {
        :uid => $auth1["uid"],
        :nickname => $auth1["info"]["nickname"],
        :name => $auth1["info"]["name"],
        :email_address => $auth1["info"]["email"],
        :created_at => Time.now})
    redirect '/addtopage/#/addtopageview'
  else
    # we just redirect to /auth/facebook here which will parse the @signed_request FB sends us, asking for auth if the user has not already granted access, or simply moving straight to the callback where they have already granted access.
    puts "post / auth me reached"
    redirect '/addtopage/#/authme'
  end

end

get '/auth/:provider/callback' do
  content_type 'application/json'
  response.set_cookie 'test', {:value => "facebook_callback", :path => "/"}
  JSON.generate(request.env)
  auth = request.env["omniauth.auth"]
  $auth1 = auth
  #need escape here to allow user to initially authorise app without the full @signed_request?
  session['fb_auth'] = auth
  session['fb_token'] = cookies[:fb_token] = auth['credentials']['token']
  session['fb_error'] = nil
  if params[:signed_request] != nil #if the signed request isn't empty
    signed_request = FBGraph::Canvas.parse_signed_request(APP_SECRET, params[:signed_request])
    if signed_request["page"] != nil #if the signed request contains page data
      $page_id = signed_request["page"]["id"]
      is_admin = signed_request["page"]["admin"]
      is_liked = signed_request["page"]["liked"]
      if is_admin #if admin, see if existing user is in db, if not create, then send to admin page
        puts "user is a page admin" #logging for dev
        User.first_or_create({:uid => auth["uid"]}, {
            :uid => auth["uid"],
            :nickname => auth["info"]["nickname"],
            :name => auth["info"]["name"],
            :email_address => auth["info"]["email"],
            :created_at => Time.now})
                                    #insert page_id into database?
        redirect '/index'
      elsif is_liked #if liked send to download end point
        puts "user has liked page" #logging for dev purposes
        redirect '/main/#/liked'
      elsif !is_liked #otherwise make them like the page
        puts "user has not liked" #logging for dev purposes
        redirect '/main/#/notliked'
      end
    else #user authed app but needs to add to page
      puts "add to page view"
      redirect '/addtopage/#/addtopageview'
    end
  else
    #needs to redirect to a page telling them that they must be on facebook or that they must authorise the application
    redirect '/index'
  end
end

helpers do
  def current_user
    @current_user ||= User.get(session[:user_id]) if session[:user_id]
  end
end

Answer 1

除了社交插件外，Facebook域名不能是iframed ，为什么？

出于安全原因，例如，假设您已登录到您的Facebook帐户我http://example.com/xss.html iframe http://facebook.com steal hi-jack fb_dtsg oAuth Dialogs iframe access_token header('X-Frame-Options: DENY');同样适用于{{1}}我可以将{{1}}来源设置为它并窃取您的{{1}}：）

我希望Facebook明白为何使用

{{1}}

“拒绝在框架中显示。” Facebook Oauth对话框

1 个答案: