Facebook Connect and ASP.NET

Question

Hello,

I'm at step 8 of the authentication overview found here: http://wiki.developers.facebook.com/index.php/How_Connect_Authentication_Works

In particular, the user has logged into facebook via Facebook Connect and their web session has been created. How do I use the facebook developer toolkit v2.0 (from clarity) to retrieve information about the user. For example, I'd like to get the user's first name and last name.

Examples in the documentation are geared towards facebook applications, which this is not.

Update

Facebook recently released the Graph API. Unless you are maintaining an application that is using Facebook Connect, you should check out the latest API: http://developers.facebook.com/docs/

Answer 1

Facebook Connect actually isn't too difficult, there's just a lack of documentation.

Put the necessary javascript from here: http://tinyurl.com/5527og

Validate the cookies match the signature provided by facebook to prevent hacking, see: http://tinyurl.com/57ry3s for an explanation on how to get started

Create an api object (Facebook.API.FacebookAPI) On the api object, set the application key and secret Facebook provides you when you create your app. Set api.SessionKey and api.UserId from the cookies created for you from facebook connect.

Once that is done, you can start making calls to facebook: Facebook.Entity.User user = api.GetUserInfo(); //will get you started with the authenticated person

Answer 2

I had a lot of trouble figuring out how to make server side calls once a user logged in with Facebook Connect. The key is that the Facebook Connect javascript sets cookies on the client once there's a successful login. You use the values of these cookies to perform API calls on the server.

This page documents the cookies: http://wiki.developers.facebook.com/index.php/Verifying_The_Signature

The confusing part was looking at the PHP sample they released. Their server side API automatically takes care of reading these cookie values and setting up an API object that's ready to make requests on behalf of the logged in user.

Here's an example using the Facebook Toolkit on the server after the user has logged in with Facebook Connect.

Server code:

API api = new API();
api.ApplicationKey = Utility.ApiKey();
api.SessionKey = Utility.SessionKey();
api.Secret = Utility.SecretKey();
api.uid = Utility.GetUserID();

facebook.Schema.user user = api.users.getInfo();
string fullName = user.first_name + " " + user.last_name;

foreach (facebook.Schema.user friend in api.friends.getUserObjects())
{
   // do something with the friend
}

Utility.cs

public static class Utility
{
 public static string ApiKey()
 {
  return ConfigurationManager.AppSettings["Facebook.API_Key"];
 }

 public static string SecretKey()
 {
  return ConfigurationManager.AppSettings["Facebook.Secret_Key"];
 }

 public static string SessionKey()
 {
  return GetFacebookCookie("session_key");
 }

 public static int GetUserID()
 {
  return int.Parse(GetFacebookCookie("user"));
 }

 private static string GetFacebookCookie(string name)
 {
  if (HttpContext.Current == null)
   throw new ApplicationException("HttpContext cannot be null.");

  string fullName = ApiKey() + "_" + name;
  if (HttpContext.Current.Request.Cookies[fullName] == null)
   throw new ApplicationException("Could not find facebook cookie named " + fullName);
  return HttpContext.Current.Request.Cookies[fullName].Value;
 }
}

Answer 3

Hey,

I followed up on this concept and wrote a full fledged article that solves this problem in ASP.NET. Please see the following.

How to Retrieve User Data from Facebook Connect in ASP.NET - Devtacular

Thanks to Calebt for a good start on that helper class.

Enjoy.

Answer 4

This is missing from the answers listed so far:

After login is successful, Facebook recommends that you validate the cookies are in fact legit and placed on the client machine by them.

Here is two methods that can be used together to solve this. You might want to add the IsValidFacebookSignature method to calebt's Utility class. Notice I have changed his GetFacebookCookie method slightly as well.

private bool IsValidFacebookSignature()
{
        //keys must remain in alphabetical order
        string[] keyArray = { "expires", "session_key", "ss", "user" };
        string signature = "";

        foreach (string key in keyArray)
            signature += string.Format("{0}={1}", key, GetFacebookCookie(key));

        signature += SecretKey; //your secret key issued by FB

        MD5 md5 = MD5.Create();
        byte[] hash = md5.ComputeHash(Encoding.UTF8.GetBytes(signature.Trim()));

        StringBuilder sb = new StringBuilder();
        foreach (byte hashByte in hash)
            sb.Append(hashByte.ToString("x2", CultureInfo.InvariantCulture));

        return (GetFacebookCookie("") == sb.ToString());
    }

    private string GetFacebookCookie(string cookieName)
    {
        //APIKey issued by FB
        string fullCookie = string.IsNullOrEmpty(cookieName) ? ApiKey : ApiKey + "_" + cookieName;

        return Request.Cookies[fullCookie].Value;
    }

The SecretKey and ApiKey are values provided to you by Facebook. In this case these values need to be set, preferably coming from the .config file.

Answer 5

Hey,

I followed up from Bill's great article, and made this little component. It takes care of identifying and validating the user from the Facebook Connect cookies.

Facebook Connect Authentication for ASP.NET

I hope that helps somebody!

Cheers,

Adam

Answer 6

Here is commercial set of ASP.NET components for Facebook Connect

Answer 7

Maybe this will help as well: http://www.suddenelfilio.net/2010/09/08/connect-to-facebook-using-asp-net-facebook-graph-api-hammock/

Answer 8

Hi,

I have blogged a couple of articles as I was learning about facebook connect, they may be really useful.

http://www.lordyz.co.uk/tag/facebook-connect/

Cheers

Chris