Canvas Developer Guide / Deploy the Web App to Heroku

Question

I try to run canvas app in Salesforce after deploy the Web App to Heroku. But in salesforce get "This App must be invoked via a signed request" instead the message Hello User.FullName. Following all instructions during Canvas Developer Guide

index.jsp

"<%@ page import="canvas.SignedRequest" %>
<%@ page import="java.util.Map" %>
<%
    // Pull the signed request out of the request body and verify/decode it.
    Map<String, String[]> parameters = request.getParameterMap();
    String[] signedRequest = parameters.get("signed_request");
    if (signedRequest == null) {%>
        This App must be invoked via a signed request!<%
        return;
    }
    String yourConsumerSecret=System.getenv("CANVAS_CONSUMER_SECRET");
    //String yourConsumerSecret="1818663124211010887";
    String signedRequestJson = SignedRequest.verifyAndDecodeAsJson(signedRequest[0], yourConsumerSecret);
%>"

"

<title>Hello World Canvas Example</title>

<link rel="stylesheet" type="text/css" href="/sdk/css/canvas.css" />

<!-- Include all the canvas JS dependencies in one file -->
<script type="text/javascript" src="/sdk/js/canvas-all.js"></script>
<!-- Third part libraries, substitute with your own -->
<script type="text/javascript" src="/scripts/json2.js"></script>

<script>
    if (self === top) {
        // Not in Iframe
        alert("This canvas app must be included within an iframe");
    }

    Sfdc.canvas(function() {
        var sr = JSON.parse('<%=signedRequestJson%>');
        // Save the token
        Sfdc.canvas.oauth.token(sr.oauthToken);
        Sfdc.canvas.byId('username').innerHTML = sr.context.user.fullName;
    });

</script>

<h1>Hello <span id='username'></span></h1>

As it appears, signedRequest == null, but I don't undestand why

Answer 1

To the original question. Is the canvas app is using self-authorization rather than admin-approved users then the first access to the app will be as part of the OAuth flow rather than a POST with the signed-request.

You would need to detect this and complete the OAuth flow first before the signed-request POST will occur.