Support the ongoing development of Laravel.io →
Authentication Security Packages

For security reasons I decided to enable "Require App Secret" on my Facebook App. Then I discovered that Laravel Socialite version "^2.0" was not working because it was not sending the appsecret_proof on the method "getUserByToken" of the class "Laravel\Socialite\Two\FacebookProvider".

I decided to make a quick fix:

 83     /**
 84      * {@inheritdoc}
 85      */
 86     protected function getUserByToken($token)
 87     {
 88       $appsecret_proof= hash_hmac('sha256', $token, $this->clientSecret);//THIS IS MY QUICK FIX
 89         $response = $this->getHttpClient()->get($this->graphUrl.'/'.$this->version.'/me?access_token='.$token.'&appsecret_proof='.$appsecret_proof.'&fields='.implode(',', $this->fields), [
 90             'headers' => [
 91                 'Accept' => 'application/json',
 92             ],
 93         ]);
 94 
 95         return json_decode($response->getBody(), true);
 96     }

Are there better solutions for this requirement? Thanks

Last updated 3 years ago.
0

Now this is solved. I sent a pull request: https://github.com/laravel/socialite/pull/100

This pull request is already merged and it is included on release v2.0.12

0

Sign in to participate in this thread!

Eventy

Your banner here too?

Moderators

We'd like to thank these amazing companies for supporting us

Your logo here?

Laravel.io

The Laravel portal for problem solving, knowledge sharing and community building.

© 2025 Laravel.io - All rights reserved.