Ruby facebook graph api appsecret_proof

Question

How can I create an appsecret_proof using Ruby for the facebook graph api?

Facebook has an example in PHP. I also saw an example in ruby in this gist.

Answer 1

I've found another way to generate the appsecret_proof for Facebook:

OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), <app_secret>, <user_access_token>)

Excerpt taken from this gist thread

Answer 2

This is code that I have that works:

  hmac = OpenSSL::HMAC.new(FB_SECRET, OpenSSL::Digest::SHA256.new)
  hmac << access_token
  proof = hmac.hexdigest
  param_hash[:appsecret_proof] = proof

Where FB_SECRET is the 32 digit (in my case) random string.

In most cases access_token is the user's login authentication token (I assume current_profile.oauth_token in your case). This token must be associated with your app. If the API call is to be made with your app's credentials and not a user's credentials you can use "#{FB_APP_ID}|#{FB_SECRET}" as your access token.

cf https://developers.facebook.com/docs/facebook-login/access-tokens