spring-bootfacebook-graph-apispring-securityoauth-2.0facebook-login

Facebook OAuth2 authentication not working for Spring Boot application


I am building a spring-boot application which uses google/facebook oauth2 authentication. The application configurations set are as follows:

    #Google
    spring.security.oauth2.client.registration.google.clientId=<googleClientId>
    spring.security.oauth2.client.registration.google.clientSecret=<googleClientSecret>
    spring.security.oauth2.client.registration.google.redirectUri={baseUrl}/oauth2/callback/{registrationId}
    spring.security.oauth2.client.registration.google.scope=email,profile
    
    #Facebook
    spring.security.oauth2.client.registration.facebook.clientId=<fbClientId>
    spring.security.oauth2.client.registration.facebook.clientSecret=<fbClientSecret>
    spring.security.oauth2.client.registration.facebook.redirectUri={baseUrl}/oauth2/callback/{registrationId}
    spring.security.oauth2.client.registration.facebook.scope=email,public_profile
    
    spring.security.oauth2.client.provider.facebook.authorizationUri=https://www.facebook.com/v13.0/dialog/oauth
    spring.security.oauth2.client.provider.facebook.tokenUri=https://graph.facebook.com/v13.0/oauth/access_token
    spring.security.oauth2.client.provider.facebook.userInfoUri=https://graph.facebook.com/v13.0/me?fields=id,first_name,middle_name,last_name,name,email,verified,is_verified,picture.width(250).height(250)

For google, this is working well - the application has an authorization rest controller which redirects to the google auth end point. After logging in, I can see a code is returned and sent to a redirect URI {baseUrl}/ouath2/callback/google, which is exchanged for a token which is in turn parsed and used to construct a universal application-level Oauth2 bearer token (for use in my shared APIs etc).

For facebook, I am attempting a similar setup. The initial redirect works, and user is directed to a facebook login page with equivalent client_id / redirect uri parameters set:

https://www.facebook.com/v3.0/dialog/oauth
    ?response_type=code
    &client_id=<fbClientId>
    &scope=email+public_profile
    &state=<state>
    &redirect_uri=https%3A%2F%2F192.168.50.150.nip.io%3A8300%2Foauth2%2Fcallback%2Ffacebook
    &ret=login
    &fbapp_pres=0
    &logger_id=e1036c5a-ac6e-448c-ab8g-655727eae993
    &tp=unspecified
    &cbt=1643459835928
    &ext=1645463198
    &hash=AeJog6HeUz9jlsDRQQo

However, when the code is obtained after login and sent to the redirect uri {baseUrl}/ouath2/callback/facebook, there is an error returned when my application attempts to access the FB User Info resource server:

Network traffic 1

Network Traffic 2

I don't have any traffic capture from my backend to the FB User Info URI, so I can't see exactly what's being sent, but the response I get back is a server error:

[invalid_user_info_response] An error occurred while attempting to retrieve the UserInfo Resource: Error details: [UserInfo Uri: https://graph.facebook.com/v3.0/me?fields=id,first_name,middle_name,last_name,name,email,verified,is_verified,picture.width(250).height(250), Error Code: server_error]

Are there any known issues with the graph.facebook.com end points?


Solution

  • Change v13 to v17, and remove field is_verified

    old

    spring.security.oauth2.client.provider.facebook.userInfoUri=https://graph.facebook.com/v13.0/me?fields=id,first_name,middle_name,last_name,name,email,verified,is_verified,picture.width(250).height(250)
    

    new

    spring.security.oauth2.client.provider.facebook.userInfoUri=https://graph.facebook.com/v17.0/me?fields=id,first_name,middle_name,last_name,name,email,verified,picture.width(250).height(250)
    

    You can test at link like this https://developers.facebook.com/tools/explorer?method=GET&path=me%3Ffields%3Did%2Cfirst_name%2Cmiddle_name%2Clast_name%2Cname%2Cemail%2Cverified%2Cpicture.width(250).height(250)&version=v17.0

    enter image description here

    Related useful config can see at https://github.com/spring-projects/spring-security/blame/main/config/src/main/java/org/springframework/security/config/oauth2/client/CommonOAuth2Provider.java