Canvas Page Form Handling

Canvas pages can be tricky, because the user's browser is pointed to one URL, say http://apps.facebook.com/drupalforfacebook, but content is really coming from a server somewhere else, say http://www.drupalforfacebook.org. It's important to realize that if you make a form post to apps.facebook.com/drupalforfacebook/..., that data is sent from user's browser to apps.facebook.com then it is forwarded on to drupalforfacebook.org/... There are some problems with this.

The first problem is very real: if your form post includes an uploaded file, it will not be forwarded! That's right, if the browser uploads a file to the apps.facebook.com/drupalforfacebook/... URL, facebook conveniently leaves that data out when the request goes to drupalforfacebook.org/... That is, your server will never know about the file.

Another potential problem is privacy. When posting to apps.facebook.com, facebook sees everything your user is doing. While this is somewhat true of any facebook application, maybe you prefer facebook not to see every value sent from your users to your server.

These problems can be addressed by building a form on the canvas page which posts directly to your server's URL, instead of apps.facebook.com/... So this is what Drupal for Facebook does, by default. Supporting this is not trivial. After the user's post, they must be redirected to a URL which starts with apps.facebook.com/... But when handling the form post, Drupal usually builds a page which it expects the user to view (rather than being redirected to another URL right away). To handle this, Drupal for Facebook caches the page that would normally be shown to the user, then redirects them to a page which displays the cached results. This is why after a form post to a canvas page, you might see a URL like: apps.facebook.com/drupalforfacebook/fb/form_cache/blah_blah_blah.

So on the one hand, we have problems with posting our data via facebook, but to solve that we add a lot of overhead to our handling of each form post. In some cases, it may not be worth the overhead. For example if your canvas page app never permits a file upload, you may prefer to always post data via facebook.

Controlling the Form Post

Drupal for Facebook's fb_canvas.module provides a function to override the default behavior. To take advantage of this, implement a custom module. Specifically in your hook_form_alter(), call the function fb_canvas_form_action_via_facebook($form). Calling this will cause the form post to go to apps.facebook.com/... instead of your server.

Here's a quick example which overrides the default behavior, unless the form's enctype has been set. Typically the enctype will be set if the form contains a file upload option.

function dff_custom_form_alter(&$form, $form_state, $form_id) {

  // Special canvas page form handling *only* when enctype is set.
  if (!isset($form['#attributes']) || !isset($form['#attributes']['enctype'])) {
    // Prevent fb_canvas from changing the form's action
    fb_canvas_form_action_via_facebook($form);
  }  

}