No errors in the logs. It looks like every time I hit the page, it runs the “make a new session and redirect” action: “Filter chain halted as [:ensure_authenticated_to_facebook] rendered_or_redirected.”
There’s no comment in view source. When I hit it with my developer account, the error message actually says ”...returned HTTP code 200 and no data”
I think there are 2 problems occurring here:
1) when ensure_authenticated_to_facebook sends a redirect after creating a session, facebook is not responding correctly. FB expects content, the app expects FB to generate its own content. The result of create_new_facebook_session_and_redirect! is a redirect to http://www.facebook.com/login.php?api_key=...key here…&v=1.0&next=%2F&canvas=true
2) when the app tries to generate a session and send it back, nothing makes it to the browser, so on the next hit, it does it again.
I think problem #2 is the key.
When I’m not logged-in, hitting the app drops me on the login page, which is correct. When I’m already logged-in, FB apparently gets confused and drops me back on the main page of the app, only the session hasn’t been set, so the app sends another redirect instead of content, but FB ignores the redirect and just complains about the lack of content.
I think this may all come down to the session not being successfully pushed back. What is the default method for session storage?
Here’s what I saw in the debugger…
Running ensure_authenticated_to_facebook -> set_facebook_session -> create_facebook_session, I see that my hit fails secure_with_facebook_params because of missing user and session_key keys in facebook_params.
It fails secure_with_cookies because of no session_key, user, expires, ss in fb_cookie_names (which is an empty array).
It fails secure_with_token because params[‘auth_token’] is empty.
Now we’re back in set_facebook_session with an empty @facebook_session.
That returns session_set (nil) back to ensure_authenticated_to_facebook, which triggers create_new_facebook_session_and_redirect.
new_facebook_session returns a new session object with auth_token, uid, expires, session_key, secret_from_session and batch_request nil. secret_key and api_key populated.
It sets next_url to ’/’ and calls top_redirect_to with http://www.facebook.com/login.php?api_key=...key here…&v=1.0&next=%2F&canvas=true
The request is not a facebook iframe, so it calls redirect_to.
In redirect_to, it is a canvas and isn’t a tab, so it renders fbml_redirect_tag as text, returning fb:redirect url=”http://www.facebook.com/login.php?api_key=...key here…&v=1.0&next=%2F&canvas=true”
It then returns false and returns to the controller.
I don’t see fb:redirect anywhere in the view source for the page.