We Keep Coding

How to prevent known and unknown bots c#

I have a simple web application, which is hosted and I have enable google search so google bots crawls, i cant find many unknown bots crawls in my application. I need to know the valid users visiting the website(except bots).
I have used
httprequest.Browser.Crawler
But it doesn’t works properly.
Can anyone please help me to prevent this fully?

You can use Request.UserAgent to see the UserAgent og requests, and then match that to a list of Crawler UserAgent strings
I would properly use a filter for this and then apply it in your filterconfig
public class CrawlerFilter : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext context)
{
var userAgent = context.HttpContext.Request.UserAgent;
//Do something with the userAgent and/or drop the request
}
}
The problem with this is that not all crawler abide by this, so you can't really be "super" certain.
Edit
i just learned that Request.Browser.Crawler is basically what I've suggested above, although the list (from Browser.Crawler) seems to not be maintained very well.

Post to Facebook group via graph api c#

I am trying to post to a facebook group via the graph api in c#.
https://developers.facebook.com/docs/graph-api/reference/v2.2/group/feed
According to the api I can post a message as well as a link to a url, here is my code to try and do this:
Uri result;
bool X = Uri.TryCreate(url, UriKind.Absolute, out result)
if(X){
// POST to group FB
dynamic fbInfo = fb.Post("/v2.2/" + "groupID" + "/feed", new
{
message = websiteDesc,
link = url
});
var fbInfoJson = fbInfo.ToString();
}
First i check that the url is absolute and if so proceed to post to the facebook group.
so far this code does post to the group but only the message and not the link.
How can I get it to post the link?
Also the api says that I can include a photo to the post but it must be a string, can i assume this is the url of the image?
Thanks in advance :)

I am not entirely sure, but the docs say "Either link or message must be supplied" so maybe you can only post a message OR a link. Definitely worth to try. It must be an absolute URL, of course. Same goes for the picture.
Posting in a group is pretty hard nowadays anyway, since you would need user_groups and publish_actions for that - and you will not get user_groups approved so you can´t use it for a public App. It will only work for users with a role in the App (Admin, Developer, Tester).

Get stream of new Facebook likes for your application

Is it possible to get response from Graph API (or FQL) that will list new likes for application and objects tied to it? Meaning - I created application, posted Like buttons all over the site - can I now get feed that will tell me what are the last 10 likes my pages received?
Related - can I somehow get list of last 10 likes of my Fan Page (something like New Likes box in Admin section)?

There is no public Facebook API that will allow you to receive a stream of the most recent likes for a collection of objects.
Furthermore, it doesn't appear to be possible to obtain a stream of likes ordered specifically by time, however it is possible to receive a list of user IDs who liked an object using the like FQL table.
like: An FQL table that returns the IDs of users who like a given object (video, note, link, photo, or album).
For example, to retrieve a list of all the user ids who liked the 'Facebook' page, you would use the FQL query:
SELECT user_id FROM like WHERE object_id="122706168308"
Which would return a list similar to this:
<fql_query_response xmlns="http://api.facebook.com/1.0/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" list="true">
<like>
<user_id>100003494051884</user_id>
</like>
<like>
<user_id>100003621882407</user_id>
</like>
<like>
<user_id>100003664580513</user_id>
</like>
<like>
<user_id>100002342537723</user_id>
</like>
<like>
<user_id>100001712929866</user_id>
</like>
<like>
<user_id>100003278394112</user_id>
</like>
</fql_query_response>
The order of the user IDs isn't clear - it may be in no specific order, or it may be ordered by time. I'd recommend that you have a bit of a fiddle with FQL and likes to see if it is in any particular order. You should also take a look at the other examples documented here.
As mentioned by Roni, it is possible to use the notifications RSS feed of your page to retrieve an RSS 2.0/XML feed of all notifications, sorted by time.
It may be possible to parse that XML to find the users who most recently liked your page, but the feed can get messy: it basically contains the HTML for each notification on the notifications page.

Question #1:
You can use Real-time Updates
Here are the steps to set up a subscription:
Set up an endpoint URL that receives both HTTP GET (for subscription verification) and > POST (for actual change data) requests from Facebook.
Make a POST to the graph API url https://graph.facebook.com//subscriptions to > subscribe, and be ready to handle the verification request.
What you get:
User connections to which you can subscribe: feed, friends, activities, interests, music, books, movies, television, likes, checkins.
What you don't get (yet):
home, tagged, posts, photos, albums, videos, groups, notes, events, inbox, outbox, updates, accounts.
Question #2:
Sure you can !
go to your Page Notifications (replace XXXX with your page ID)
you will find there an RSS link which you can use without even making a Graph API call
You will receive notifications when visitors interact with your page.
For example, if a visitor likes your page or a fan writes on your
wall, you will receive a notification.

How to make a route unique

I use asp.net 4 c# and routing.
I have two routes, as you can see I pass to arguments for each route {ContentId} and {TitleUrl}, please pay attention at the first part article/ and blog/.
Here an example of correct resulted
mysite.com/article/150/my-special-article
mysite.com/blog/25/my-special-blogpost
If a User try to manipulate the URL changing article/ and blog/ section, the route continue to display the content.
mysite.com/article/150/my-special-article // same page
mysite.com/somtheingelsehere/150/my-special-article // same page
My web site at the moment continue to display the content, but I need some sort of validation and make sure that my requested URL is as specified in the route or I would show a 404 page.
Any idea how could solve it? (I hope guys I was able to explain in properly, if you need more clarificaiton please let me know). Thanks!
routes.MapPageRoute("ArticleDetails", "article/{ContentId}/{TitleUrl}", "~/ContentDetails.aspx");
routes.MapPageRoute("BlogPostDetails", "blog/{ContentId}/{TitleUrl}", "~/ContentDetails.aspx");

My suggestion is either use different pages for articles and blog posts, or in ContentDetails.aspx check for the correct URL accordingly.
if (Request.Url.PathAndQuery.StartsWith("/blog/") && postType = "blog") ...

Problem getting access_token after migrating to OAuth 2.0

I have tried migrating my app to the OAuth 2.0 routine. I am having trouble getting the access_token from the cookie set by the JavaScript API. I decode the information in the cookie, but instead of an access_token and the user information I get a code. This seems like a rather weird change.
Is there any workaround for this, because it seems that you can't get your code exchanged to an access_token when you haven't specified a redirect_uri when you acquired the code.
I have considered just taking the access_token from the response in the JavaScript API and storing it in a cookie, but that kinda defeats the whole purpose of the extended security and I wanted to ask if there was a proper way to do it.
Could be that I am doing something wrong though, and if that is the case please tell me :)
EDIT
I am aware that the cookie holds a signed request, but according to the docs that signed request should hold the information I require like access_token and uid, but in my instance it only holds the code. That is basically the part I don't understand.

Turns out that (even though it is not documented) we need to exchange the code for an access_token ourselves. I think this is a total waste since that was the nice thing about the old cookie. It was fast and easy to get the access_token.
Anyway. To get the access_token from the new cookie you need to do the following:
public string ReturnAccessToken()
{
HttpCookie cookie = htc.Request.Cookies[string.Format("fbsr_{0}", facebookAppID)];
string jsoncode = System.Text.ASCIIEncoding.ASCII.GetString(FromBase64ForUrlString(cookie.Value.Split(new char[] { '.' })[1]));
JsonData data = JsonMapper.ToObject(jsoncode);
getAccessToken(data["code"].ToJson()
}
private string getAccessToken(string code)
{
//Notice the empty redirect_uri! And the replace on the code we get from the cookie.
string url = string.Format("https://graph.facebook.com/oauth/access_token?client_id={0}&redirect_uri={1}&client_secret={2}&code={3}", "YOUR_APP_ID", "", "YOUR_APP_SECRET", code.Replace("\"", ""));
System.Net.HttpWebRequest request = System.Net.WebRequest.Create(url) as System.Net.HttpWebRequest;
System.Net.HttpWebResponse response = null;
using (response = request.GetResponse() as System.Net.HttpWebResponse)
{
System.IO.StreamReader reader = new System.IO.StreamReader(response.GetResponseStream());
string retVal = reader.ReadToEnd();
return retVal;
}
}
public byte[] FromBase64ForUrlString(string base64ForUrlInput)
{
int padChars = (base64ForUrlInput.Length % 4) == 0 ? 0 : (4 - (base64ForUrlInput.Length % 4));
StringBuilder result = new StringBuilder(base64ForUrlInput, base64ForUrlInput.Length + padChars);
result.Append(String.Empty.PadRight(padChars, '='));
result.Replace('-', '+');
result.Replace('_', '/');
return Convert.FromBase64String(result.ToString());
}
This may seem a bit redundant, but I suppose you can store the access_token in a session variable. If you do this and iFrame the your app on Facebook you need to know that it will not work in IE 6, 7 and 8 if the user have set his browser privacy settings to medium. There is a workaround for this, but as it is not a part of this question I will not write it. If people really want it, write a comment and I will show it :)
-----------------------------------EDIT------------------------------------------
When using any of the old IE browsers you can't use cookies or session variables in pages that are Iframed in, like your pages on Facebook. This is a problem that can't really be solved sufficiently in coding. By sufficiently I mean that the solution is not nice. You need to set the p3p-header in your response. You can of course do this in coding for all the pages that you service, but the easiest solution (if you are using a .NET server to host your pages) is to set up a p3p policy for the IIS. A guide for this can be seen in http://support.microsoft.com/kb/324013. It shouldn't matter what you write in the p3p policy (if you check Facebooks own you can see that they use "We don't have a p3p policy), the important part is that there stands something. I have had troubles just using random text though, but if you use the text in the example there shouldn't be a problem :)
This took me forever to find out, so I hope someone can use it :D

Unfortunately I don't have the answer directly, but I do have a documentation bug that I filed against facebook in order to try to get the documentation there: http://bugs.developers.facebook.net/show_bug.cgi?id=20363
I have a similar problem that when I try to decode the signedRequest from the authResponse of FB.login, they payload contains something like:
{"algorithm":"HMAC-SHA256","code":"THE_CODE_HERE","issued_at":1315433244,"user_id":"THE_USER_ID"}
As you stated, the docs do talk about how to turn that code into an access_token. That appears to be in the "Server Side" documentation here: http://developers.facebook.com/docs/authentication/
If you grab the accessToken from FB.login you can get it from the js and cache it, but as you said, that isn't actually signed, and could relatively easily be faked.
And you're right, this doesn't appear to have any of the useful information that's described here: developers.facebook.com/docs/authentication/signed_request/ (http removed since I don't have enough reputation points yet to post more than 2 links - sorry)
Perhaps you can vote up my bug? I'll post this link on that bug too.

fbsr_APP_ID cookie is actually a signed_request, check out facebook official docs how do you decode signed request verify signature and get the user information. You can look also at official php SDK source how they get access token from there.

You have to use the code to get the actual access_token.