Post-Remove (Uninstall) URL

Problem

I’d like to be able to collect some statistics when users remove my application, but I don’t get any kind of notice from Facebook.

Solution

You can specify a Post-Remove URL in your app’s settings, which Facebook will ping with a POST request when a user removes your app.

Discussion

The important thing to note is that users won’t be sent to the URL when they remove it, but rather that you’ll get a POST request from Facebook with some useful information, listed in Table 9-8.

Table 9-8. Post-remove URL parameters

Name

Type

Description

fb_sig_uninstall

bool

This will always be true (1).

fb_sig_time

string

The uninstall timestamp in epoch seconds (see Formatting Relative Time for more info on epoch time).

fb_sig_user

int

uid (user ID) of the user who removed the app.

fb_sig_api_key

string

API key of the app being uninstalled.

fb_sig

string

Signature of the POST, made up of the other parameters and the app’s secret key hashed into an MD5 hash.

You should verify that the POST requests you receive are valid by building your own version of fb_sig and then checking that they match:

$sig = ''; ksort($_POST); foreach ($_POST as $key => $value) { if (substr($key, 0, 7) == 'fb_sig_') { $sig .= substr($key, 7) . '=' . $value; } } $sig .= $secret; $verify = md5($sig); if ($verify == $_POST['fb_sig'] && $_POST['fb_uninstall'] == true) { // The signatures match and this is an uninstall request, // so go ahead and do it } else { // This is a forged request or not an uninstall, ...

Get Facebook Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.