How to get req.body from Facebook's data deletion URL call?

user_11367400 0
Viewed 3067

I've implemented the "sign in with Facebook" authorization method for my Express.js Node app. Since the app is hosted in the EU, Facebook requires it to have a data deletion request callback URL.

I've created an endpoint for the data deletion request, but whenever I make Facebook call that endpoint both req.body and req.query are empty - if I've understood correctly the body should contain a signed_request that could be used to e.g. verify the caller.

My CORS settings should be fine and I've tested my endpoint by calling it from Postman. The endpoint is able to receive a POST request with a JSON body without any problem.

So, what am I doing wrong - why does it seem like Facebook is calling my endpoint with a POST request that has an empty body?

My endpoint:

import express from 'express'; // 4.17.1
const router = express.Router();

router.post('/fb_data_deletion', (req, res, next) => {
    console.log(req.body); // {}
    console.log(req.query); // {}

    if (!req.body || !req.body.signed_request) {
        console.log('Bad request'); // Ends up here whenever Facebook calls this route
        return req.sendStatus(400);
    }

    // verify request, delete user's data + other code here

});
express node.js facebook
1 Answers

Turns out Facebook isn't sending a POST request that uses Content-Type application/json but application/x-www-form-urlencoded.

To get the body of Facebook's POST request I had to add the following line to my app.js where the Node server is being set up:

app.use(express.urlencoded());
user_113674000
Related