在 Python 中处理 Facebook 取消授权回调

Question

我正在构建一个使用 Facebook 登录的 Django 应用程序django-allauth. I would like to know when an user removes my corresponding Facebook App, and Facebook provides such functionality in the form of a deauthorize callback. There are also some instructions on how to parse the request using PHP in the documentation。

然而，将其翻译成 Python 似乎并不像我想的那么容易，因为我在解码发布的 base64 编码字符串时得到 'Padding Errors'，这看起来很奇怪我.

Answer 1

问题似乎是某个填充必须手动添加到发布的数据中。这是一个工作示例：

class DeauthorizeView(View):

    def post(self, request, *args, **kwargs):
        try:
            signed_request = request.POST['signed_request']
            encoded_sig, payload = signed_request.split('.')
        except (ValueError, KeyError):
            return HttpResponse(status=400, content='Invalid request')

        try:
            # Reference for request decoding: https://developers.facebook.com/docs/games/gamesonfacebook/login#parsingsr
            # For some reason, the request needs to be padded in order to be decoded. See 
            decoded_payload = base64.urlsafe_b64decode(payload + "==").decode('utf-8')
            decoded_payload = json.loads(decoded_payload)

            if type(decoded_payload) is not dict or 'user_id' not in decoded_payload.keys():
                return HttpResponse(status=400, content='Invalid payload data')

        except (ValueError, json.JSONDecodeError):
            return HttpResponse(status=400, content='Could not decode payload')

        try:
            secret = SocialApp.objects.get(id=1).secret

            sig = base64.urlsafe_b64decode(encoded_sig + "==")
            expected_sig = hmac.new(bytes(secret, 'utf-8'), bytes(payload, 'utf-8'), hashlib.sha256)
        except:
            return HttpResponse(status=400, content='Could not decode signature')

        if not hmac.compare_digest(expected_sig.digest(), sig):
            return HttpResponse(status=400, content='Invalid request')

        user_id = decoded_payload['user_id']

        try:
            social_account = SocialAccount.objects.get(uid=user_id)
        except SocialAccount.DoesNotExist:
            return HttpResponse(status=200)

        # Own custom logic here

        return HttpResponse(status=200)

在 Python 中处理 Facebook 取消授权回调

Handle Facebook Deauthorize Callback in Python

python

django

facebook-login