title: ASP.NET MVC5 OWIN Facebook authentication suddenly not working
body: <p><strong>Update 2017!</strong></p>
  
  <p>The issue I had when I posted the original question has got nothing to do with the recent changes Facebook made when they forced everyone to version 2.3 of their API.  For a solution to that specific problem, see <strong>sammy34's answer below</strong>.  Version 2.3 of the /oauth/access_token endpoint now returns JSON instead of form-encoded values</p>
  
  <p><strong>For historical reasons, here's my original question/issue:</strong></p>
  
  <p>I've got an MVC5 Web application which is using the built-in support for authentication via Facebook and Google.  When we built this app a few months ago, we followed this tutorial: <a href="http://www.asp.net/mvc/tutorials/mvc-5/create-an-aspnet-mvc-5-app-with-facebook-and-google-oauth2-and-openid-sign-on" rel="noreferrer">http://www.asp.net/mvc/tutorials/mvc-5/create-an-aspnet-mvc-5-app-with-facebook-and-google-oauth2-and-openid-sign-on</a> and everything worked great.</p>
  
  <p>Now, all of a sudden, the Facebook authentication has just stopped working alltogether.  The Google authentication still works great.</p>
  
  <p>Description of the problem: We click the link to connect using Facebook, we are redirected to Facebook where we are prompted if we wan't to allow our Facebook app access to our profile.  When we click "OK" we are redirected back to our site, but instead of being logged in we simply end up at the login screen.</p>
  
  <p>I've gone through this process in debug mode and I've got this ActionResult in my account controller as per the tutorial mentioned above:</p>
  
  <pre><code>// GET: /Account/ExternalLoginCallback
  [AllowAnonymous]
  public async Task&lt;ActionResult&gt; ExternalLoginCallback(string returnUrl)
  {
      var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
      if (loginInfo == null)
      {
          return RedirectToAction("Login");
      }
      ............
  </code></pre>
  
  <p>When stepping through the code and upon returning from Facebook, the loginInfo object is always NULL, which causes the user to be redirected back to the login.</p>
  
  <p>In order to understand what is actually happening behind the scenes, I installed Fiddler and monitored the HTTP traffic.  What I disovered is that upon clicking "OK" at the Facebook permission dialog, Facebook redirects back to our application with this URL:</p>
  
  <pre><code>https://localhost/signin-facebook?code=&lt;access-token&gt;
  </code></pre>
  
  <p>This URL is not an actual file and probably handled by some controller/handler built into this OWIN framework I'm guessing.  Most likely, it is connecting back to Facebook using the given code to query information about the user which is trying to login.  Now, the problem is that instead of doing that, we are redirected to:</p>
  
  <pre><code>/Account/ExternalLoginCallback?error=access_denied
  </code></pre>
  
  <p>Which I'm sure is something Facebook is doing, that is, instead of giving us the user data, it's redirecting us back with this error message.</p>
  
  <p>This causes the <code>AuthenticationManager.GetExternalLoginInfoAsync();</code> to fail and always return NULL.</p>
  
  <p>I'm completely out of ideas.  As far as we know, we did not change anything on our end.</p>
  
  <p>I've tried creating a new Facebook app, I've tried following the tutorial again but I always have the same problem.</p>
  
  <p>Any ideas welcome!</p>
  
  <p><strong>Update!</strong></p>
  
  <p>OK, this is driving me insane!  I've now manually gone through the steps required to perform the authentication and everything works great when I do that.  Why on earth is this not working when using the MVC5 Owin stuff?</p>
  
  <p>This is what I did:</p>
  
  <pre><code>    // Step 1 - Pasted this into a browser, this returns a code
      https://www.facebook.com/dialog/oauth?response_type=code&amp;client_id=619359858118523&amp;redirect_uri=https%3A%2F%2Flocalhost%2Fsignin-facebook&amp;scope=&amp;state=u9R1m4iRI6Td4yACEgO99ETQw9NAos06bZWilJxJrXRn1rh4KEQhfuEVAq52UPnUif-lEHgayyWrsrdlW6t3ghLD8iFGX5S2iUBHotyTqCCQ9lx2Nl091pHPIw1N0JV23sc4wYfOs2YU5smyw9MGhcEuinvTAEql2QhBowR62FfU6PY4lA6m8pD3odI5MwBYOMor3eMLu2qnpEk0GekbtTVWgQnKnH6t1UcC6KcNXYY
  
  I was redirected back to localhost (which I had shut down at this point to avoid being redirected immediately away).  The URL I was redirected to is this:
  
  https://localhost/signin-facebook?code=&lt;code-received-removed-for-obvious-reasons&gt;
  
  Now, I grabbed the code I got and used it in the URL below:
  
  // Step 2 - opened this URL in a browser, and successfully retrieved an access token
  https://graph.facebook.com/oauth/access_token?client_id=619359858118523&amp;redirect_uri=https://localhost/signin-facebook&amp;client_secret=&lt;client-secret&gt;&amp;code=&lt;code-from-step-1&gt;
  
  // Step 3 - Now I'm able to query the facebook graph using the access token from step 2!
  
  https://graph.facebook.com/me?access_token=&lt;access-token-from-step-2&gt;
  </code></pre>
  
  <p>No errors, everything works great!  Then why the hell is this not working when using the MVC5 Owin stuff?  There's obviously something wrong with the OWin implementation.</p>