title: Facebook deauthorize callback is not called
body: <p>I have develop an Facebook app (a game in "development mode") consumed by a web client (Facebook canvas) and a mobile client (Android app). I have also a REST API (developed with Laravel) which allow the exchanges between clients and the Facebook API. The API is reachable over the internet (not localhost).</p>
  
  <p><strong>My aim is to detect when users uninstall my Facebook app.</strong></p>
  
  <p>The <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/v2.1" rel="noreferrer">Facebook documentation</a> says that:</p>
  
  <blockquote>
    <p>People are able to uninstall apps via Facebook.com without interacting
    with the app itself. To help apps detect when this has happened, we
    allow them to provide a de-authorize callback URL which will be pinged
    whenever this occurs.</p>
    
    <p>You can enable a deauthorize callback via the App Dashboard. Just go
    to your app, then choose the Settings menu, and finally the Advanced
    tab. A text field is provided for the Deauthorize Callback URL.</p>
    
    <p>Whenever a user of your app de-authorizes it, this URL will be sent an
    HTTP POST containing a signed request. Read our guide to parsing the
    signed request to see how to decode this to find out the user ID that
    triggered the callback.</p>
  </blockquote>
  
  <p>The Laravel route for this URL accepts <code>GET</code> and <code>POST</code> requests. I know that the Facebook callback uses <code>POST</code> request, but accepting the <code>GET</code> method allows me to use the "<a href="https://developers.facebook.com/tools/debug/og/object/" rel="noreferrer">Open Graph Object Debugger</a>" tool to test if my URL is reachable by Facebook servers (and it is successful).</p>
  
  <p>Currently I use a self-signed SSL certificate <em>(AES 128)</em>. Apache is my web server (it redirects all HTTP requests to HTTPS).</p>
  
  <p>I know <a href="https://developers.facebook.com/docs/facebook-login/using-login-with-games#parsingsr" rel="noreferrer">how to decode</a> the <code>signed_request</code> encoded POST parameter (the problem is not here).</p>
  
  <p><strong>Problem:</strong></p>
  
  <p>When I remove the app (with a Facebook test account) <strong>the callback URL is never called</strong>. The Apache logs (access/error) show absolutely nothing (while I can see previous access via the Open Graph Object Debugger).</p>
  
  <p>I have tried to change the callback URL by another domain with a SSL certificate delivered by a known CA. Same result...  this is very frustrating.</p>
  
  <p>I don't understand why. I missed something?</p>
  
  <ul>
  <li>It is an issue with my web server? </li>
  <li>It is an issue with my SSL certificate?</li>
  <li>It is an issue with my Facebook app configuration?</li>
  <li>It is because my Facebook app is in development mode?</li>
  <li>It is a Facebook bug?</li>
  </ul>
  
  <p><img src="https://i.stack.imgur.com/8fNlq.png" alt="enter image description here"></p>