nopSolutions/nopCommerce · error · NopException

Request data is missing

Error message

Request data is missing

What it means

Thrown by FacebookDataDeletionController.DataDeletionCallback as a NopException when form['signed_request'] is null or empty. Facebook sends a signed_request in the form body of data-deletion callbacks; its absence means the request is malformed or not a genuine Facebook callback.

Source

Thrown at src/Plugins/Nop.Plugin.ExternalAuth.Facebook/Controllers/FacebookDataDeletionController.cs:70

        str = str.Replace("-", "+").Replace("_", "/");
        var paddingToAdd = (str.Length % 4) == 3 ? 1 : (str.Length % 4);
        var charToAdd = new string('=', paddingToAdd);

        return str += charToAdd;
    }

    #endregion

    #region Methods

    [HttpPost]
    public async Task<IActionResult> DataDeletionCallback(IFormCollection form)
    {
        try
        {
            string signed_request = form["signed_request"];
            if (string.IsNullOrEmpty(signed_request))
                throw new NopException("Request data is missing");

            var split = signed_request.Split('.');
            var signatureRaw = DecodeUrlBase64(split[0]);
            var dataRaw = DecodeUrlBase64(split[1]);
            if (string.IsNullOrEmpty(signatureRaw) || string.IsNullOrEmpty(dataRaw))
                throw new NopException("Part of the request data is missing");

            var signature = Convert.FromBase64String(signatureRaw);
            var dataBuffer = Convert.FromBase64String(dataRaw);
            var json = Encoding.UTF8.GetString(dataBuffer);
            var appSecretBytes = Encoding.UTF8.GetBytes(_facebookExternalAuthSettings.ClientSecret);
            HMAC hmac = new HMACSHA256(appSecretBytes);
            var expectedHash = hmac.ComputeHash(Encoding.UTF8.GetBytes(split[1]));
            if (!expectedHash.SequenceEqual(signature))
                throw new NopException("Hash validation failed");

            var fbUser = JsonConvert.DeserializeObject<FacebookUserDTO>(json);
            var authenticationParameters = new ExternalAuthenticationParameters

View on GitHub (pinned to 64bdf2ff08)

Solutions

1. Confirm the data-deletion callback URL registered in the Facebook app exactly matches this endpoint.
2. Ensure the request reaches the controller with the multipart/form-data body intact (check reverse proxies).
3. For testing, POST a real signed_request generated with your app secret.

Example fix

// before: curl -X POST https://shop/Facebook/DataDeletionCallback   (no body)
// after: include signed_request
//   curl -X POST https://shop/Facebook/DataDeletionCallback \
//        -d 'signed_request=<payload>.<signature>'

string signed = form["signed_request"];
if (string.IsNullOrEmpty(signed))
    return BadRequest("signed_request is required.");

static bool HasSignedRequest(IFormCollection form) =>
    !string.IsNullOrEmpty(form["signed_request"]);

try { return await DataDeletionCallback(form); }
catch (NopException ex) when (ex.Message.Contains("Request data is missing"))
{ return BadRequest(ex.Message); }

When it happens

Trigger: A POST to the data-deletion callback endpoint with no 'signed_request' field — e.g. a probe, a misconfigured webhook, a manual test without the field, or Facebook retrying a malformed payload.

Common situations: Someone hits the endpoint directly; webhook URL registered with Facebook is wrong and Facebook posts a different payload shape; a proxy/load balancer strips form fields.

Related errors

• Part of the request data is missing
• Hash validation failed
• Facebook authentication module cannot be loaded
• Facebook authentication module not configured
• Only zip archives are supported (*.zip)

AI-assisted analysis of nopSolutions/nopCommerce@64bdf2ff08 (2026-08-13). Data as JSON: /api/errors/a0e66f910180fde6. Report an issue: GitHub.