Koala::Utils.logger.warn("Signed cookie didn't contain Faceb

Error message

Koala::Utils.logger.warn("Signed cookie didn't contain Facebook OAuth code! Components: #{components}")

What it means

This entry is a logged warning, not a raised exception: when parse_signed_cookie verifies the fbsr_<app_id> cookie signature but the decoded envelope has no code field, Koala logs Signed cookie did not contain Facebook OAuth code! with the decoded components and returns nil. Callers see a nil result from get_user_info_from_cookies and should treat the user as not logged in rather than hunting for a thrown error.

Source

Thrown at lib/koala/oauth.rb:300

        sig == components["sig"] && (components["expires"] == "0" || Time.now.to_i < components["expires"].to_i) ? components : nil
      end

      def parse_signed_cookie(fb_cookie)
        components = parse_signed_request(fb_cookie)
        if code = components["code"]
          begin
            token_info = get_access_token_info(code, :redirect_uri => '')
          rescue Koala::Facebook::OAuthTokenRequestError => err
            if err.fb_error_type == 'OAuthException' && err.fb_error_message =~ /Code was invalid or expired/
              return nil
            else
              raise
            end
          end

          components.merge(token_info) if token_info
        else
          Koala::Utils.logger.warn("Signed cookie didn't contain Facebook OAuth code! Components: #{components}")
          nil
        end
      end

      def fetch_token_string(args, post = false, endpoint = "access_token", options = {})
        response = Koala.make_request("/oauth/#{endpoint}", {
          :client_id => @app_id,
          :client_secret => @app_secret
        }.merge!(args), post ? "post" : "get", {:use_ssl => true}.merge!(options))

        raise ServerError.new(response.status, response.body) if response.status >= 500
        raise OAuthTokenRequestError.new(response.status, response.body) if response.status >= 400

        response.body
      end

      # base 64
      # directly from https://github.com/facebook/crypto-request-examples/raw/master/sample.rb

View on GitHub (pinned to 47d052063e)

Solutions

Treat nil from get_user_info_from_cookies as not authenticated and route to login; a missing code is a normal Facebook state, not a bug.
Delete the fbsr_<app_id> cookie after a nil parse so the JS SDK issues a fresh cookie at the next login.
If the log noise matters, adjust the Koala::Utils.logger level or alert filters instead of changing the auth logic.

Example fix

// before
auth = @oauth.get_user_info_from_cookies(cookies.to_h)
raise "no facebook auth" unless auth

// after
auth = @oauth.get_user_info_from_cookies(cookies.to_h)
if auth && auth["access_token"]
  session[:fb_auth] = auth
else
  cookies.delete("fbsr_#{APP_ID}") # stale cookie: let the JS SDK write a new one
  redirect_to login_path
end

Defensive patterns

Strategy: fallback

Validate before calling

cookie = cookies["fbsr_#{APP_ID}"]
user_info = cookie ? @oauth.get_user_info_from_cookies(cookies.to_h) : nil

Type guard

def authenticated?(info)
  info.is_a?(Hash) && info["access_token"].is_a?(String) && !info["access_token"].empty?
end

Prevention

Always branch on the nil return of get_user_info_from_cookies; do not assume a hash
Clear the fbsr_ cookie whenever parsing yields nil so the browser stops resending a dead cookie
Teach log alerts the difference between this benign warning and OAuthSignatureError; only the latter signals verification failure

When it happens

Trigger: get_user_info_from_cookies receives an fbsr_ cookie whose envelope passes HMAC verification but lacks components["code"]: cookies left behind by a login that never completed, envelopes Facebook emits for logged-out or deauthorized states, or a JS SDK version that writes the cookie without a redeemable code.

Common situations: Users who logged out, changed a password, or removed the app leaving stale cookies; upgrading the Facebook JS SDK; alerting pipelines (Sentry, log scanners) that promote this warning text to an incident while the app itself correctly shows the login screen.

Related errors

AI-assisted analysis of arsduo/koala@47d052063e (2026-08-23). Data as JSON: /api/errors/7861c1b55f8757cd. Report an issue: GitHub.