CORS issue with Facebook/Twitter in Backbone request about grant HOT 6 CLOSED

You can't use AJAX request for that. You have to redirect the user instead:

window.location = '/connect/facebook'

So it's not what you would expect from a single page app, but the authorization_code OAuth2 flow and the similar OAuth1 one, that Grant is concerned with, requires redirecting to a third party server.

from grant.

Thanks! It works. The final question is, does Grant support sending appsecret_proof for Facebook security?

from grant.

The appsecret_proof parameter seems to be used for securing all requests after the initial user login. Check out here, the access token and the app secret are used to generate the app secret proof.

from grant.

yeah but when Grant generates the request it seems not to be sending this appsecret_proof=<generated-in-the-server>'. If i'm missing something I apologize

from grant.

Grant is concerned with providing you with access_token. You can't have appsecret_proof before having an access_token:

# the PHP code from the above link
$appsecret_proof= hash_hmac('sha256', $access_token, $app_secret); 

You have to generate the appsecret_proof after you get the access_token using Grant.

from grant.

oh, got it ! Thanks a lot for helping me. Regards.

from grant.