Take the 2-minute tour ×

I want to ask a user to grant the "publish_stream" permission to my app with the facebook javascript sdk.

I initialize it like this:

    appId  : '203702512703',
    status : true, // check login status
    xfbml  : true, // parse XFBML
    channelURL : 'http://mydomain.com/channel.php', // channel.html file
    oauth  : true // enable OAuth 2.0

And my FB.ui call looks like this:

    client_id: '203702512703',
    method: 'oauth',
    scope: 'publish_stream',
    redirect_uri: 'http://mydomain.com/',
    response_type: 'token',
    display: 'dialog'

If i change 'dialog' to 'popup' it works perfectly. But if i specify 'dialog' or leave the option out it shows me the fb-div but with a loading animation (like this: http://p.iqs.me/t1c4j ) and the content never loads.

What am i doing wrong?

UPDATE: I found this page http://developers.facebook.com/docs/reference/dialogs/#display that says the following about using "iframe" as display: "Because of the risk of clickjacking, this is only allowed for some certain dialogs, and requires you to pass a valid access_token"

Doesn't say anything like that about "dialog" thought but both iframe and dialog gives the same bad result.

How would i pass in the access_token?

share|improve this question
Is you issue similar to this bug? –  ifaour Sep 29 '11 at 16:37
Seems a bit similar. But if this is a bug i guess thousands of apps would suffer from it. It's more likely that i'm doing something wrong here. –  Martin Sep 29 '11 at 17:33

2 Answers 2

up vote 1 down vote accepted

'popup' is mandatory for method: 'oauth' or FB.login for javascript SDK because of security (clickjacking and phishing). I'd suggest to use FB.login anyway to get permissions or to authenticate because it is more convenient.

hope this helps

share|improve this answer
Okay. Thanks :) This is not very well documented. –  Martin Sep 29 '11 at 18:52
@Martin: I agree –  Anatoly Lubarsky Sep 29 '11 at 22:27

There is also a discrepancy in the way you can use display: iframe for FB.login depending on whether you're in a tab or on a canvas. On a tab you don't need an access_token and on a canvas you do.

So on a canvas, you're stuck with either pop-ups being blocked or a good percentage of users refusing to provide basic permissions for something as simple as a post to their own wall that they initiated. IMVHO FB need to rectify this asap but I've had a bug logged against it for months and there's been no sign of a change.

share|improve this answer

Your Answer


