I'm about to attack setting up Canvas Pages, and would like to ask for a clarification: I have seen a lot of stuff recently (poking around in the Facebook documentation and the web) about Canvas Pages requiring SSL and a certificate. However, in the documentation for the module there is no mention of this (that I can find). Do I need to set up a certificate on my server to make Canvas Pages work? From my standpoint there is no point in having SSL because the pages are public, but is this a technical requirement?
I have read the documentation and I am in the process of setting up the module, going step by step and making sure everything works as I go (so far I have succeeded in logging in and creating new users in Drupal from their Facebook id). So, this is not in the "I'm not paying attention" category, but it may be in the "I've not understood what this is about, at all" category.
Thanks in advance, JG

Comments

Dave Cohen’s picture

Dave Cohen commented

It's hard to get definitive yes or no answers from facebook. Whatever their policy is today, it is subject to change. That said, my understanding is....

If the user goes to http://apps.facebook.com/YOUR_APP, you do not need to support HTTPS.

If the user visits https://apps.facebook.com/YOUR_APP (note the https), your server needs to support HTTPS.

The latest 6.x-3.x-dev build includes a setting where you can tell modules/fb whether your server supports HTTPS or not, and it will try to set the secure callbacks correctly.

joel_guesclin’s picture

joel_guesclin commented

Many thanks for this, and for your patience. I have successfully made a start and managed to get a page to display in an app (though the documentation needs updating because the Facebook interface and some of the parameters have changed. At the moment, although Facebook says that SSL will be obligatory after 1st October 2011, it still accepts an http setting, and displays the page even though I don't have SSL set up on the server (I used http://apps...).
One thing I'm not sure about is the setting in Drupal for the Facebook page. I've designed a new page with a URL http://en.mysite.com/facebook, and it took me a while to work out that the setting required in "Canvas pages" under the App settings required a trailing slash, viz "facebook/".
I'm a bit confused at the moment, however, about how to get the app to appear on my "home" page in Facebook (by which I mean the page I want visitors to see first). I've set up a Facebook "business" page (it's actually for a not-fpr-profit), but when I edit the page and try to add an app, the only choices I get are a series of standard Facebook apps. I confess I find Facebook incredibly confusing to use, and I realise this is not the place to get Facebook help as such, but any pointers would be welcome.

Dave Cohen’s picture

Dave Cohen commented

You shouldn't have to mess with the trailing slash yourself. Instead edit the application on Drupal and it will automatically set that property.

Make sure you've read the readme, edited your settings.php, etc.

joel_guesclin’s picture

joel_guesclin commented

I'm not sure exactly what I did, but my first effort at canvas pages now works. I think probably you are right that I did not completely understand the workflow in editing all the settings. The other possibility is that I was too impatient, and did not wait the necessary time for Facebook to spread the information to all its servers.
As regards SSL, as things stand it works ok as long as my user accessing the app has not switched on secure browsing. With secure browsing switched on, I get an SSL protocol error, viz: Error 107 (net::ERR_SSL_PROTOCOL_ERROR)

joel_guesclin’s picture

joel_guesclin commented

Basically, the answer is yes. Since I set up a test SSL certificate on my site, I have been able to connect to my app with no problems.

13rac1’s picture

13rac1 commented
Status: Active » Closed (works as designed)

Agreed. The answer is basically yes. Many people connect to Facebook using HTTPS only (myself included.) They/I cannot access any FB App that allows HTTP only.

joel_guesclin’s picture

joel_guesclin commented

Actually, I think it now goes further than this: whether or not you are connected to Facebook via SSL, Facebook seems to require SSL when connecting to the App