Visualforce Canvas App not getting signed request

Question

I have a connected app, with canvas component in a visualforce page using <apex:canvasApp>. Signed Request (POST) is enabled.

If I admin-approve users, the canvas app gets a valid Signed Request POSTed with auth_token and refresh_token, like expected.

The problem occurs if I choose user self-authorization: I initiate the OAuth flow using Sfdc.canvas.oauth.loginand on the Callback URL, I use window.opener.Sfdc.canvas.oauth.childWindowUnloadNotification(window.location.hash) to emit the result to the canvas.

This reloads the canvas page and I can then access the auth_token using Sfdc.canvas.oauth.token()

However, a call to Sfdc.canvas.client.refreshSignedRequest leads to a respone Code 403 "userApprovalRequired" with empty payload.

I can see in the background a http request made to https://eu3.salesforce.com/services/data/v36.0/platformconnect/signedrequest, returning an encoded response. If I decode it using my client secret, it gives me a CanvasRequest with issuedAt = NULL and no auth_token or refresh_token

Also, calling Sfdc.canvas.client.repost({refresh : true}) does not lead to a POST on my canvas page, but again a GET request with _sfdc_canvas_authvalue = user_approval_required

Am I missing a step or doeing something wrong?

Answer 1

I just solved the problem.

You need to initialize a Web Server OAuth Authentication Flow using

response_type : 'code'

and complete fetching the tokens on the server. After you complete the oauth flow you can call the repost() function on the canvas page and you will get the signed request.

A User-Agent OAuth Authentication Flow is not good enough it seems.