{"record":{"id":"7a0994efa360b15f","repo":"nopSolutions/nopCommerce","slug":"part-of-the-request-data-is-missing","errorCode":null,"errorMessage":"Part of the request data is missing","messagePattern":"Part of the request data is missing","errorType":"exception","errorClass":"NopException","httpStatus":null,"severity":"error","filePath":"src/Plugins/Nop.Plugin.ExternalAuth.Facebook/Controllers/FacebookDataDeletionController.cs","lineNumber":76,"sourceCode":"\n    #endregion\n\n    #region Methods\n\n    [HttpPost]\n    public async Task<IActionResult> DataDeletionCallback(IFormCollection form)\n    {\n        try\n        {\n            string signed_request = form[\"signed_request\"];\n            if (string.IsNullOrEmpty(signed_request))\n                throw new NopException(\"Request data is missing\");\n\n            var split = signed_request.Split('.');\n            var signatureRaw = DecodeUrlBase64(split[0]);\n            var dataRaw = DecodeUrlBase64(split[1]);\n            if (string.IsNullOrEmpty(signatureRaw) || string.IsNullOrEmpty(dataRaw))\n                throw new NopException(\"Part of the request data is missing\");\n\n            var signature = Convert.FromBase64String(signatureRaw);\n            var dataBuffer = Convert.FromBase64String(dataRaw);\n            var json = Encoding.UTF8.GetString(dataBuffer);\n            var appSecretBytes = Encoding.UTF8.GetBytes(_facebookExternalAuthSettings.ClientSecret);\n            HMAC hmac = new HMACSHA256(appSecretBytes);\n            var expectedHash = hmac.ComputeHash(Encoding.UTF8.GetBytes(split[1]));\n            if (!expectedHash.SequenceEqual(signature))\n                throw new NopException(\"Hash validation failed\");\n\n            var fbUser = JsonConvert.DeserializeObject<FacebookUserDTO>(json);\n            var authenticationParameters = new ExternalAuthenticationParameters\n            {\n                ProviderSystemName = FacebookAuthenticationDefaults.SystemName,\n                AccessToken = await HttpContext.GetTokenAsync(FacebookDefaults.AuthenticationScheme, \"access_token\"),\n                ExternalIdentifier = fbUser.UserId\n            };\n            var externalAuthenticationRecord = await _externalAuthenticationService.GetExternalAuthenticationRecordByExternalAuthenticationParametersAsync(authenticationParameters);","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/nopSolutions/nopCommerce/blob/64bdf2ff08c8b39e65717bcf974fb43dc2ef68f2/src/Plugins/Nop.Plugin.ExternalAuth.Facebook/Controllers/FacebookDataDeletionController.cs#L58-L94","documentation":"Thrown by FacebookDataDeletionController.DataDeletionCallback as a NopException when, after splitting signed_request on '.', the decoded signature or payload half is empty. It indicates the signed_request was present but malformed (missing one of the two parts).","triggerScenarios":"signed_request contains no '.' separator (Split yields one element; accessing [0]/[1] may also IndexOutOfRange earlier) or one half base64-url-decodes to an empty string. Caused by truncated/corrupted Facebook payloads or a non-conforming sender.","commonSituations":"A truncated signed_request from a proxy; a manually crafted test value missing the signature or payload part; an older Facebook API format.","solutions":["Inspect the raw signed_request value at the failing request to confirm it has both '<signature>.<payload>' parts.","Ensure no middleware truncates the form field value.","Regenerate the test signed_request with both parts using your app secret."],"exampleFix":"// before: signed_request = \"abc\"            (single part)\n// after:  signed_request = \"<sig>.<payload>\"  (two dot-separated base64url parts)","handlingStrategy":"validation","validationCode":"var parts = signed.Split('.');\nif (parts.Length != 2 || string.IsNullOrEmpty(parts[0]) || string.IsNullOrEmpty(parts[1]))\n    return BadRequest(\"Malformed signed_request.\");","typeGuard":"static bool IsWellFormedSignedRequest(string s)\n{ var p = s.Split('.'); return p.Length == 2 && !string.IsNullOrEmpty(p[0]) && !string.IsNullOrEmpty(p[1]); }","tryCatchPattern":"try { return await DataDeletionCallback(form); }\ncatch (NopException ex) when (ex.Message.Contains(\"Part of the request data\"))\n{ return BadRequest(ex.Message); }","preventionTips":["Validate the two-part structure before decoding.","Guard against IndexOutOfRange when the dot is missing.","Log raw signed_request length for diagnostics."],"tags":["external-auth","plugins","facebook","webhook","validation","security"],"backgroundTag":null,"analyzedSha":"64bdf2ff08c8b39e65717bcf974fb43dc2ef68f2","analyzedAt":"2026-08-13T21:19:38.062Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}