Facebook Callback appends ‘#_=_’ to Return URL

via Facebook’s Platform Updates: Change in Session Redirect Behavior This week, we started adding a fragment #____=____ to the redirect_uri when this field is left blank. Please ensure that your app can handle this behavior. To prevent this, set the redirect_uri in your login url request like so: (using Facebook php-sdk) $facebook->getLoginUrl(array(‘redirect_uri’ => $_SERVER[‘SCRIPT_URI’],’scope’ => … Read more

How to identify if a webpage is being loaded inside an iframe or directly into the browser window?

Browsers can block access to window.top due to same origin policy. IE bugs also take place. Here’s the working code: function inIframe () { try { return window.self !== window.top; } catch (e) { return true; } } top and self are both window objects (along with parent), so you’re seeing if your window is … Read more

What’s the shebang/hashbang (#!) in Facebook and new Twitter URLs for?

This technique is now deprecated. This used to tell Google how to index the page. https://developers.google.com/webmasters/ajax-crawling/ This technique has mostly been supplanted by the ability to use the JavaScript History API that was introduced alongside HTML5. For a URL like www.example.com/ajax.html#!key=value, Google will check the URL www.example.com/ajax.html?_escaped_fragment_=key=value to fetch a non-AJAX version of the contents.

How does Facebook disable the browser’s integrated Developer Tools?

I’m a security engineer at Facebook and this is my fault. We’re testing this for some users to see if it can slow down some attacks where users are tricked into pasting (malicious) JavaScript code into the browser console. Just to be clear: trying to block hackers client-side is a bad idea in general; this … Read more