CSRF state token does not match one provided
facebook, facebook-graph-api, php
Solution
`getLoginUrl()` generates a new token. If your user is already logged in (with `$user_id = $facebook->getUser()`), you'll end up with 2 tokens.
Don't ask for the $loginUrl if the user is authenticated already.
$user_id = $facebook->getUser();
if ($user_id) {
$_SESSION['user_id'] = $user_id;
echo "<script>top.location.href = 'https://www.example.com/app-folder/welcome'</script>";
exit;
} else {
$loginUrl = $facebook->getLoginUrl(array(
'scope' => 'publish_stream')
);
}
?>
Problem
I know there are tons of post on stackoverflow about the issue on "CSRF state token does not match one provided." However, I tried and doesn't seem to solve the issue. Can you please take a look at my code below? Please tell me what you think and how to solve the problem. I have already updated to latest PHP SDK version. ``` <? require_once ('src/facebook.php'); require_once ('src/fbconfig.php'); //Facebook Authentication part $user_id = $facebook->getUser(); $loginUrl = $facebook->getLoginUrl(array( 'scope' => 'publish_stream') ); if ($user_id) { $_SESSION['user_id'] = $user_id; echo "<script>top.location.href = 'https://www.example.com/app-folder/welcome'</script>"; exit; } ?> . . <body> <?php echo '<a href="'.$loginUrl.'" target="_top">Please login</a>'; ?> . . </body> ```