No longer working after removing my site from Facebook via "Apps and Websites"

Question

My website (Spring MVC) allows users to sign up by using their Facebook accounts and sign into my site later with their Facebook accounts. I use scribejava (version 6.6.3) (https://github.com/scribejava/scribejava) for the Oauth integration with Facebook.

I have tested a use case and am unable to find a way to resolve it. Here is the list of steps:

1. The tester goes to my site's "Log in" page, clicks "Log in with Facebook", grants permissions at Facebook, gets redirected to my site, and signs out. This is a normal and successful flow.
2. The tester sign into Facebook at Facebook.com
3. The tester goes to Settings->Apps and Websites and removes my site
4. The tester goes to my site's "Log in" page, clicks "Log in with Facebook" button, gets redirected to Facebook, and sees an error message.

At step 4, the tester always gets an error message at the Facebook site instead of asking the tester to grant permissions again. See the following screenshot:

I cannot find a way at Facebook to remove this message when clicking on the "Log in with Facebook" button. Here is my code for the web interface. Did I miss something?

@RequestMapping( value="/facebook", method = RequestMethod.GET)
public void facebook(HttpServletRequest request, 
        @RequestParam(value = "page", required = true) String page,
        HttpServletResponse response) throws Exception {

    try {

        OAuth20Service service =  new ServiceBuilder(config.getProperty("facebook.clientId"))
            .apiSecret(config.getProperty("facebook.clientSecret"))
            .callback(getCallback())
        .build(FacebookApi.instance());

        String authUrl = service.getAuthorizationUrl(); 

        response.sendRedirect(authUrl);

    } catch (Exception e) {

        response.sendRedirect("/oauthFail");
    }       

}

@RequestMapping( value="/facebook/callback", method = RequestMethod.GET)
public void facebookCallback(HttpServletRequest servletRequest,
        @RequestParam(value = "code", required = false) String code,
        @RequestParam(value = "error", required = false) String error,
        HttpServletResponse servletResponse
        ) throws Exception {

    try {

        OAuth20Service service =  new ServiceBuilder(config.getProperty("facebook.clientId"))
            .apiSecret(config.getProperty("facebook.clientSecret"))
            .callback(getCallback())
        .build(FacebookApi.instance());

        OAuth2AccessToken accessToken = service.getAccessToken(code);  

        final OAuthRequest request = new OAuthRequest(Verb.GET, "https://graph.facebook.com/v3.2/me");
        service.signRequest(accessToken, request);        
        final com.github.scribejava.core.model.Response response = service.execute(request);

        String body = response.getBody();
        JSONObject jObject = new JSONObject(body);
        String email = jObject.getString("email");

        //success. use the email to create an account or if the email address exists, direct a userto their account page

    } catch (Exception e) {

        response.sendRedirect("/oauthFail");
    }

}   

How to handle this situation? I feel either something is wrong is my code or scribejava has a framework issue. Or this is a Facebook specific issue?

Answer 1

I have just tested the case. Couldn't reproduce. Did you try running this Example https://github.com/scribejava/scribejava/blob/master/scribejava-apis/src/test/java/com/github/scribejava/apis/examples/FacebookExample.java ? I think your problem can be with API versions logic in Facebook. You can try to explicitly use the latest one .build(FacebookApi.customVersion("3.2"))