{"record":{"id":"7861c1b55f8757cd","repo":"arsduo/koala","slug":"koala-utils-logger-warn-signed-cookie-didn-t-con","errorCode":null,"errorMessage":"Koala::Utils.logger.warn(\"Signed cookie didn't contain Facebook OAuth code! Components: #{components}\")","messagePattern":"Koala::Utils\\.logger\\.warn\\(\"Signed cookie didn't contain Facebook OAuth code! Components: #(.+?)\"\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/koala/oauth.rb","lineNumber":300,"sourceCode":"        sig == components[\"sig\"] && (components[\"expires\"] == \"0\" || Time.now.to_i < components[\"expires\"].to_i) ? components : nil\n      end\n\n      def parse_signed_cookie(fb_cookie)\n        components = parse_signed_request(fb_cookie)\n        if code = components[\"code\"]\n          begin\n            token_info = get_access_token_info(code, :redirect_uri => '')\n          rescue Koala::Facebook::OAuthTokenRequestError => err\n            if err.fb_error_type == 'OAuthException' && err.fb_error_message =~ /Code was invalid or expired/\n              return nil\n            else\n              raise\n            end\n          end\n\n          components.merge(token_info) if token_info\n        else\n          Koala::Utils.logger.warn(\"Signed cookie didn't contain Facebook OAuth code! Components: #{components}\")\n          nil\n        end\n      end\n\n      def fetch_token_string(args, post = false, endpoint = \"access_token\", options = {})\n        response = Koala.make_request(\"/oauth/#{endpoint}\", {\n          :client_id => @app_id,\n          :client_secret => @app_secret\n        }.merge!(args), post ? \"post\" : \"get\", {:use_ssl => true}.merge!(options))\n\n        raise ServerError.new(response.status, response.body) if response.status >= 500\n        raise OAuthTokenRequestError.new(response.status, response.body) if response.status >= 400\n\n        response.body\n      end\n\n      # base 64\n      # directly from https://github.com/facebook/crypto-request-examples/raw/master/sample.rb","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/arsduo/koala/blob/47d052063ef8b5644fb59e279da0b52687999f55/lib/koala/oauth.rb#L282-L318","documentation":"This entry is a logged warning, not a raised exception: when parse_signed_cookie verifies the fbsr_<app_id> cookie signature but the decoded envelope has no code field, Koala logs Signed cookie did not contain Facebook OAuth code! with the decoded components and returns nil. Callers see a nil result from get_user_info_from_cookies and should treat the user as not logged in rather than hunting for a thrown error.","triggerScenarios":"get_user_info_from_cookies receives an fbsr_ cookie whose envelope passes HMAC verification but lacks components[\"code\"]: cookies left behind by a login that never completed, envelopes Facebook emits for logged-out or deauthorized states, or a JS SDK version that writes the cookie without a redeemable code.","commonSituations":"Users who logged out, changed a password, or removed the app leaving stale cookies; upgrading the Facebook JS SDK; alerting pipelines (Sentry, log scanners) that promote this warning text to an incident while the app itself correctly shows the login screen.","solutions":["Treat nil from get_user_info_from_cookies as not authenticated and route to login; a missing code is a normal Facebook state, not a bug.","Delete the fbsr_<app_id> cookie after a nil parse so the JS SDK issues a fresh cookie at the next login.","If the log noise matters, adjust the Koala::Utils.logger level or alert filters instead of changing the auth logic."],"exampleFix":"// before\nauth = @oauth.get_user_info_from_cookies(cookies.to_h)\nraise \"no facebook auth\" unless auth\n\n// after\nauth = @oauth.get_user_info_from_cookies(cookies.to_h)\nif auth && auth[\"access_token\"]\n  session[:fb_auth] = auth\nelse\n  cookies.delete(\"fbsr_#{APP_ID}\") # stale cookie: let the JS SDK write a new one\n  redirect_to login_path\nend","handlingStrategy":"fallback","validationCode":"cookie = cookies[\"fbsr_#{APP_ID}\"]\nuser_info = cookie ? @oauth.get_user_info_from_cookies(cookies.to_h) : nil","typeGuard":"def authenticated?(info)\n  info.is_a?(Hash) && info[\"access_token\"].is_a?(String) && !info[\"access_token\"].empty?\nend","tryCatchPattern":null,"preventionTips":["Always branch on the nil return of get_user_info_from_cookies; do not assume a hash","Clear the fbsr_ cookie whenever parsing yields nil so the browser stops resending a dead cookie","Teach log alerts the difference between this benign warning and OAuthSignatureError; only the latter signals verification failure"],"tags":["oauth","cookie","warning","login","koala","facebook"],"backgroundTag":"missing-oauth-code","analyzedSha":"47d052063ef8b5644fb59e279da0b52687999f55","analyzedAt":"2026-08-23T10:19:03.891Z","schemaVersion":2},"datasetVersion":"2026-08-23T13:39:53.451Z"}