Detecting User Page Likes with Facebook API: Evolution from pages.isFan to signed_request

Limitations of Traditional Methods

In Facebook iFrame app development, detecting if a user likes a specific page is a common requirement. Early developers often used FB.api to call the pages.isFan method, as shown in the following code:

FB.api({
    method:     "pages.isFan",
    page_id:        my_page_id,
},  function(response) {
        console.log(response);
        if(response){
            alert('You Likey');
        } else {
            alert('You not Likey :(');
        }
    }
);

However, this approach has significant drawbacks: it requires the user to have granted extended permissions. In practice, many users may not have authorized or may have denied permission, leading to incorrect API results. For example, even if the current user is a page fan, it might return false, causing functionality to fail.

Improved Solution Based on signed_request

Facebook provides a more reliable alternative: by enabling OAuth 2.0 for Canvas, a signed_request parameter is sent with each page request. This parameter contains encrypted user and page information that can be parsed without additional permissions.

Here is the core PHP implementation function:

function parsePageSignedRequest() {
    if (isset($_REQUEST['signed_request'])) {
      $encoded_sig = null;
      $payload = null;
      list($encoded_sig, $payload) = explode('.', $_REQUEST['signed_request'], 2);
      $sig = base64_decode(strtr($encoded_sig, '-_', '+/'));
      $data = json_decode(base64_decode(strtr($payload, '-_', '+/'), true));
      return $data;
    }
    return false;
  }

This function first checks if signed_request exists, then splits it into signature and payload parts. Through Base64 decoding and JSON parsing, it ultimately returns an object containing user status.

Application Logic and Security Considerations

The parsed data object includes a page->liked property that directly indicates whether the user likes the page. The application logic is as follows:

if($signed_request = parsePageSignedRequest()) {
    if($signed_request->page->liked) {
      echo "This content is for Fans only!";
    } else {
      echo "Please click on the Like button to view this tab!";
    }
  }

This method avoids permission dependencies, enhancing reliability. However, developers must note: signed_request originates from Facebook servers, and its signature should be verified to prevent forgery. Although the example code does not show complete verification, signature validation must be implemented in production environments.

Technical Details and Character Escaping

During implementation, proper handling of strings and HTML tags is crucial. For instance, <code> tags in the code mark code snippets, while similar structures in text, such as <br>, need to be escaped as <br> to avoid being parsed as HTML elements. This ensures document structure integrity and readability.

Additionally, the strtr function used in Base64 decoding converts URL-safe characters (- and _) to standard characters (+ and /), which is a key step in processing Facebook data formats.

Conclusion and Best Practices

The evolution from pages.isFan to signed_request reflects security improvements in Facebook API design. Developers should prioritize the latter and integrate it with OAuth 2.0 for user authentication. In code, attention to permission management, data validation, and character escaping can build more stable and secure social applications.