nopSolutions/nopCommerce · error · NopException

Part of the request data is missing

Error message

Part of the request data is missing

What it means

Thrown by FacebookDataDeletionController.DataDeletionCallback as a NopException when, after splitting signed_request on '.', the decoded signature or payload half is empty. It indicates the signed_request was present but malformed (missing one of the two parts).

Source

Thrown at src/Plugins/Nop.Plugin.ExternalAuth.Facebook/Controllers/FacebookDataDeletionController.cs:76

    #endregion

    #region Methods

    [HttpPost]
    public async Task<IActionResult> DataDeletionCallback(IFormCollection form)
    {
        try
        {
            string signed_request = form["signed_request"];
            if (string.IsNullOrEmpty(signed_request))
                throw new NopException("Request data is missing");

            var split = signed_request.Split('.');
            var signatureRaw = DecodeUrlBase64(split[0]);
            var dataRaw = DecodeUrlBase64(split[1]);
            if (string.IsNullOrEmpty(signatureRaw) || string.IsNullOrEmpty(dataRaw))
                throw new NopException("Part of the request data is missing");

            var signature = Convert.FromBase64String(signatureRaw);
            var dataBuffer = Convert.FromBase64String(dataRaw);
            var json = Encoding.UTF8.GetString(dataBuffer);
            var appSecretBytes = Encoding.UTF8.GetBytes(_facebookExternalAuthSettings.ClientSecret);
            HMAC hmac = new HMACSHA256(appSecretBytes);
            var expectedHash = hmac.ComputeHash(Encoding.UTF8.GetBytes(split[1]));
            if (!expectedHash.SequenceEqual(signature))
                throw new NopException("Hash validation failed");

            var fbUser = JsonConvert.DeserializeObject<FacebookUserDTO>(json);
            var authenticationParameters = new ExternalAuthenticationParameters
            {
                ProviderSystemName = FacebookAuthenticationDefaults.SystemName,
                AccessToken = await HttpContext.GetTokenAsync(FacebookDefaults.AuthenticationScheme, "access_token"),
                ExternalIdentifier = fbUser.UserId
            };
            var externalAuthenticationRecord = await _externalAuthenticationService.GetExternalAuthenticationRecordByExternalAuthenticationParametersAsync(authenticationParameters);

View on GitHub (pinned to 64bdf2ff08)

Solutions

  1. Inspect the raw signed_request value at the failing request to confirm it has both '<signature>.<payload>' parts.
  2. Ensure no middleware truncates the form field value.
  3. Regenerate the test signed_request with both parts using your app secret.

Example fix

// before: signed_request = "abc"            (single part)
// after:  signed_request = "<sig>.<payload>"  (two dot-separated base64url parts)
Defensive patterns

Strategy: validation

Validate before calling

var parts = signed.Split('.');
if (parts.Length != 2 || string.IsNullOrEmpty(parts[0]) || string.IsNullOrEmpty(parts[1]))
    return BadRequest("Malformed signed_request.");

Type guard

static bool IsWellFormedSignedRequest(string s)
{ var p = s.Split('.'); return p.Length == 2 && !string.IsNullOrEmpty(p[0]) && !string.IsNullOrEmpty(p[1]); }

Try / catch

try { return await DataDeletionCallback(form); }
catch (NopException ex) when (ex.Message.Contains("Part of the request data"))
{ return BadRequest(ex.Message); }

Prevention

When it happens

Trigger: signed_request contains no '.' separator (Split yields one element; accessing [0]/[1] may also IndexOutOfRange earlier) or one half base64-url-decodes to an empty string. Caused by truncated/corrupted Facebook payloads or a non-conforming sender.

Common situations: A truncated signed_request from a proxy; a manually crafted test value missing the signature or payload part; an older Facebook API format.

Related errors

AI-assisted analysis of nopSolutions/nopCommerce@64bdf2ff08 (2026-08-13). Data as JSON: /api/errors/7a0994efa360b15f. Report an issue: GitHub.