{"action":"created","issue":{"url":"https://api.github.com/repos/mkdynamic/omniauth-facebook/issues/176","labels_url":"https://api.github.com/repos/mkdynamic/omniauth-facebook/issues/176/labels{/name}","comments_url":"https://api.github.com/repos/mkdynamic/omniauth-facebook/issues/176/comments","events_url":"https://api.github.com/repos/mkdynamic/omniauth-facebook/issues/176/events","html_url":"https://github.com/mkdynamic/omniauth-facebook/issues/176","id":54326323,"number":176,"title":"Re-asking facebook permissions","user":{"login":"Vrael","id":1472843,"avatar_url":"https://avatars.githubusercontent.com/u/1472843?v=3","gravatar_id":"","url":"https://api.github.com/users/Vrael","html_url":"https://github.com/Vrael","followers_url":"https://api.github.com/users/Vrael/followers","following_url":"https://api.github.com/users/Vrael/following{/other_user}","gists_url":"https://api.github.com/users/Vrael/gists{/gist_id}","starred_url":"https://api.github.com/users/Vrael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Vrael/subscriptions","organizations_url":"https://api.github.com/users/Vrael/orgs","repos_url":"https://api.github.com/users/Vrael/repos","events_url":"https://api.github.com/users/Vrael/events{/privacy}","received_events_url":"https://api.github.com/users/Vrael/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-14T14:15:16Z","updated_at":"2015-01-15T19:01:04Z","closed_at":"2015-01-15T18:54:06Z","body":"In Facebook login view an user can decline permissions. Perhaps the permissions which were declined affect to the app functionality (you can do less things with this app because some data is not accessible)\r\n\r\nI would like warn to the user and re-ask the permissions again. But I don't see what is the way with Omniauth-Facebook. In Facebook documentation shows the way to accomplish this is adding a parameter to the request login called: auth_type=rerequest\r\n```ruby\r\nhttps://www.facebook.com/dialog/oauth?\r\n    client_id={app-id}&\r\n    redirect_uri={redirect-uri}&\r\n    auth_type=rerequest&\r\n    scope=email\r\n```\r\n\r\nI have not seen the way to do this directly with Omniauth I tried to call this url from 'auth/facebook/callback' after checking the permissions by myself, but I get the following error when the user re-accepts the permission in the new login:\r\n\r\n```\r\n ERROR -- omniauth: (facebook) Authentication failure! invalid_credentials: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected\r\nOmniAuth::Strategies::OAuth2::CallbackError: csrf_detected | CSRF detected\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/failure_endpoint.rb:25:in `raise_out!'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/failure_endpoint.rb:20:in `call'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/failure_endpoint.rb:12:in `call'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/strategy.rb:475:in `fail!'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-oauth2-1.2.0/lib/omniauth/strategies/oauth2.rb:73:in `callback_phase'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-facebook-1.6.0/lib/omniauth/strategies/facebook.rb:71:in `callback_phase'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/strategy.rb:227:in `callback_call'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/strategy.rb:184:in `call!'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/strategy.rb:164:in `call'\r\n    /home/ciro/.rvm/gems/ruby-2.1.3/gems/omniauth-1.2.2/lib/omniauth/builder.rb:59:in `call'\r\n```\r\nThis is my 'auth/facebook/callback'\r\n```ruby\r\non get do\r\n  on 'auth/facebook/callback' do\r\n    on param(:code) do |code| \r\n      email = req.env['omniauth.auth']['info']['email'] \r\n\r\n      if email.nil? or email.empty?\r\n        res.redirect \"https://www.facebook.com/dialog/oauth?client_id=#{ENV['APP_ID']}&redirect_uri=http://localhost:9292/auth/facebook/callback&auth_type=rerequest&scope=email\"\r\n      end\r\n    end\r\n  end\r\nend\r\n```\r\nWith parameter 'provider_ignores_state: true' this works, but then the app is vulnerable to CSRF attacks. Exist other way to accomplish it?"},"comment":{"url":"https://api.github.com/repos/mkdynamic/omniauth-facebook/issues/comments/70141010","html_url":"https://github.com/mkdynamic/omniauth-facebook/issues/176#issuecomment-70141010","issue_url":"https://api.github.com/repos/mkdynamic/omniauth-facebook/issues/176","id":70141010,"user":{"login":"simi","id":193936,"avatar_url":"https://avatars.githubusercontent.com/u/193936?v=3","gravatar_id":"","url":"https://api.github.com/users/simi","html_url":"https://github.com/simi","followers_url":"https://api.github.com/users/simi/followers","following_url":"https://api.github.com/users/simi/following{/other_user}","gists_url":"https://api.github.com/users/simi/gists{/gist_id}","starred_url":"https://api.github.com/users/simi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simi/subscriptions","organizations_url":"https://api.github.com/users/simi/orgs","repos_url":"https://api.github.com/users/simi/repos","events_url":"https://api.github.com/users/simi/events{/privacy}","received_events_url":"https://api.github.com/users/simi/received_events","type":"User","site_admin":false},"created_at":"2015-01-15T19:01:04Z","updated_at":"2015-01-15T19:01:04Z","body":"YAY!"}}