title: Weird Facebook API behavior. CSRF state token does not match one provided
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/8977502/csrf-state-token-does-not-match-one-provided-fb-php-sdk-3-1-1-oauth-2-0">CSRF state token does not match one provided FB PHP SDK 3.1.1 Oauth 2.0</a><br>
    <a href="https://stackoverflow.com/questions/11957455/csrf-state-token-does-not-match-one-provided">CSRF state token does not match one provided</a>  </p>
  </blockquote>
  
  
  
  <p>I checked again and again with Devs facing a similar issue with Facebook API. The PHP-SDK logs an error on every run that says</p>
  
  <pre><code>CSRF state token does not match one provided.
  </code></pre>
  
  <p>The weird thing is, the intended application seems to work fine (It's a batch posting script and as soon as I reset the batch, it generates this error.)</p>
  
  <p>So I tracked down to base_facebook.php in the PHP-SDK provided <a href="https://github.com/facebook/facebook-php-sdk" rel="nofollow noreferrer">here</a>. and changed this code (in <a href="https://github.com/facebook/facebook-php-sdk/blob/master/src/base_facebook.php" rel="nofollow noreferrer">here</a>):</p>
  
  <pre><code>protected function getCode() {
      if (isset($_REQUEST['code'])) {
        if ($this-&gt;state !== null &amp;&amp;
            isset($_REQUEST['state']) &amp;&amp;
            $this-&gt;state === $_REQUEST['state']) {
  
          // CSRF state has done its job, so clear it
          $this-&gt;state = null;
          $this-&gt;clearPersistentData('state');
          return $_REQUEST['code'];
        } else {
          self::errorLog('CSRF state token does not match one provided.');
          return false;
        }
      }
  </code></pre>
  
  <p>to this one (just to track errors in the error log):</p>
  
  <pre><code>protected function getCode() {
      if (isset($_REQUEST['code'])) {
        if ($this-&gt;state !== null &amp;&amp; isset($_REQUEST['state']) &amp;&amp; $this-&gt;state == $_REQUEST['state']) {
          // CSRF state has done its job, so clear it
          $this-&gt;state = null;
          $this-&gt;clearPersistentData('state');
          return $_REQUEST['code'];
        } else {
          $add = '';
          if($this-&gt;state == null){
              $add .= ' state is null.';
          }
          if(!isset($_REQUEST['state'])){
              $add .= ' state is not set.';
          }
          if($this-&gt;state !== $_REQUEST['state']){
              $add .= ' states do not match.';
          }
          self::errorLog('CSRF state token does not match one provided.'. $add);
          return false;
        }
      }
  
      return false;
    }
  </code></pre>
  
  <p>On running the app again, I get the updated error to:</p>
  
  <pre><code>CSRF state token does not match one provided. state is null. states do not match.
  </code></pre>
  
  <p>now, $this->state() is NULL, I did not expect this to be the least of the errors in facebook sdk. I'm sure my app only generates one login url request, that too only if the user has no session with my app.</p>
  
  <p>Help will be appreciated.</p>