Facebook PHP-SDK with CodeIgniter not returning $_REQUEST['signed_request']

Despite all the downvotes, I was able to find the solution to this VERY serious BUG found in Facebook PHP-SDK with CodeIgniter.

So here's the solution found in CI forums: http://codeigniter.com/forums/viewthread/202370/#986781

    // Stop cache    $this->ci->output->set_header("Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0");    $this->ci->output->set_header("Pragma: no-cache");    // IE Fix    if(strpos($this->ci->agent->agent_string(), 'MSIE') !== FALSE) {        $this->ci->output->set_header('p3p: CP="ALL DSP COR PSAa PSDa OUR NOR ONL UNI COM NAV"');    }    // Repopulate _REQUEST ... Facebook needs it.    $request_uri = $_SERVER['REQUEST_URI'];    $request_uri = explode('?',$request_uri);    if(count($request_uri) > 1) {        parse_str($request_uri[1], $_REQUEST);    }

For some reason, the new PHP SDK doesn't pass $_REQUEST through CodeIgniter. There's also issues with cache, and IE not having proper header.

So this builds $_REQUEST from $_SERVER['REQUEST_URI'], which then properly passes through Facebook class and successfully returns proper data.

Use this instruction this might help

$signed_request = isset($_REQUEST['signed_request']) ? $_REQUEST['signed_request'] : $this->modelfacebook->signRequest();

According to one of the answers in this post, CodeIgniter purges the $_REQUEST variable for security reasons. I assume it's related to the automatic input filtering described in the Codeigniter Manual here, but it's not specifically mentioned there either though. I am unsure whether setting

 $config['global_xss_filtering'] = TRUE;

in config.php affects it or not (I have it set to TRUE in mine), but at least now you/we know why the $_REQUEST variable is not available.

Interestingly, I have the FB SDK library in my CIApplication/libraries/ folder and it seems to access the $_REQUEST variable fine, just not in my views or controllers.

Was looking for the answer to the same question when I came across this post - and yours is a perfectly valid, good question too!

CheersMatt