Laravel中Facebook登录模块异常：Session为空无法跳转

Hey there, let's break down why you're hitting that empty session and 400 Bad Request error with your Facebook login flow. As a Laravel newbie, these sorts of OAuth/cookie-related bugs are super common—let's fix this step by step.

First, Let's Diagnose the Core Problems #

From your code and error message, two big issues stand out:

1. Laravel CSRF Protection Blocking Your Request: AJAX GET requests to routes under the web middleware require a CSRF token, which your current frontend code isn't sending.
2. Facebook JavaScript Login Helper Reliance on Cookies: The helper you're using relies on client-side cookies that often break in local HTTP environments (like localhost) or if your Facebook app settings aren't configured correctly.

Step 1: Fix the CSRF Token Issue #

Laravel's default middleware blocks any non-GET request without a CSRF token, but even GET requests can get flagged if your route is in the web group. Update your frontend AJAX call to include the token:

body.on('loggedIn:fb', function(){
    if(!User.isLoggedIn()) {
        var loginModal = $('#loginModal');
        loginModal.addClass("logging-in");
        $.get(BASE_PATH + '/login/fb', {
            _token: '{{ csrf_token() }}', // Add CSRF token here
            access_token: FB.getAuthResponse().accessToken // Pass Facebook's access token directly
        }).success(function(response){
            User.setData(response.user);
            $('body').trigger('loggedIn');
        }).fail(function(response){
            $('body').trigger('login:error', response);
        }).always(function(){
            loginModal.removeClass("logging-in");
        });
    }
});

Step 2: Rewrite Backend to Use Explicit Access Tokens #

Instead of relying on the FacebookJavaScriptLoginHelper (which is flaky in local environments), use the access token sent from the frontend to create a valid Facebook session directly. Here's the updated loginWithFb method:

public function loginWithFb() {
    $redirectUrl = Input::get('redirect_url');
    $config = app('siteConfig');
    $facebookConfig = $config['main']['social']['facebook'];
    
    // Validate Facebook app credentials first
    if(empty($facebookConfig['appId']) || empty($facebookConfig['secret'])) {
        return Response::make('Facebook app credentials missing', 500);
    }

    FacebookSession::setDefaultApplication($facebookConfig['appId'], $facebookConfig['secret']);
    $session = null;

    // Move this to a private method instead of an internal function
    $getUserDataFromFb = function($session) {
        $request = new FacebookRequest($session, 'GET', '/me');
        $response = $request->execute();
        return $response->getGraphObject()->asArray();
    };

    // Use the access token from the frontend first
    $accessToken = Input::get('access_token');
    if ($accessToken) {
        try {
            $session = new FacebookSession($accessToken);
            // Validate the token is legitimate
            $session->validate();
        } catch(FacebookRequestException $ex) {
            \Log::error("Facebook token error: " . $ex->getMessage());
            return Response::make('Invalid Facebook token', 400);
        } catch(\Exception $ex) {
            \Log::error("Token validation error: " . $ex->getMessage());
            return Response::make('Failed to validate login', 400);
        }
    } 
    // Fallback to helper if no token is sent (for non-AJAX flows)
    else {
        $helper = new FacebookJavaScriptLoginHelper();
        try {
            $session = $helper->getSession();
        } catch(FacebookRequestException $ex) {
            \Log::error("Facebook request error: " . $ex->getMessage());
        } catch(\Exception $ex) {
            \Log::error("Local login error: " . $ex->getMessage());
        }
    }

    if(Request::ajax()) {
        if ($session) {
            $uid = $session->getUserId();
            $profile = Profile::whereUid($uid)->first();
            $me = $getUserDataFromFb($session);

            if (empty($profile)) {
                // Create new user and profile
                $user = new User;
                $user->name = $me['first_name'].' '.$me['last_name'];
                $user->email = $me['email'];
                $user->photo = "https://graph.facebook.com/{$uid}/picture?type=large";
                $user->save();

                $profile = new Profile();
                $profile->uid = $uid;
                $profile->access_token = $session->getToken();
                $user->profiles()->save($profile);
            } else {
                // Update existing profile's access token
                $profile->access_token = $session->getToken();
                $profile->save();
            }

            Auth::login($profile->user);
            return Response::json(['user' => $profile->user]);
        } else {
            return Response::make('Not logged in', 400);
        }
    } else{
        if ($session) {
            return $redirectUrl ? Redirect::to($redirectUrl) : Redirect::route('home');
        }
        return Redirect::route('login');
    }
}

Step 3: Double-Check Facebook App Settings #

Your Facebook app must be configured correctly for local testing:

• Go to your Facebook Developer Dashboard
• Under Settings > Basic:
  • Add localhost to App Domains
• Under Products > Facebook Login > Settings:
  • Add http://localhost/Script/login/fb to Valid OAuth Redirect URIs (match your exact route)

Bonus: Fix the Internal Function Issue #

In your original code, the getUserDataFromFb internal function can't access external variables properly. Moving it to a private method (or using a closure like above) makes your code cleaner and avoids scope bugs.

Try these changes, and you should see the session get populated correctly, allowing the login flow to redirect to your homepage as expected.

内容的提问来源于stack exchange，提问作者user3653474