Canvas App started sending GET instead of POST

Question

I have a canvas app that is setup to use the signed request (POST) access method, and when I test the app via either the tab that it creates or the canvas app previewer it sends my webserver a POST with the signed request as expected.

I have this app in a managed package and have been sending install links to other developers on the project for quite awhile now and everything has been working fine, but I recently made a minor change to the package and sent out a new install link and now other people that install the app are sending GET requests to the webserver instead of POSTs.

the GETs look like

?_sfdc_canvas_auth=user_approval_required&loginUrl=https%3A%2F%2Flogin.salesforce.com%2F

which, I assume is for the OAuth webflow (GET) access method which I have not set my connected app to use, and my webserver is not set up to handle.

My first thought was that maybe the change I had made to the app caused this issue, but I asked them to install an old version of the managed package and they are still having this issue even with the old version that definitely used to work and sent POSTs correctly.

any idea what has happened to my app?

Answer 1

See Signed Request Authentication.

Has:

• a change been made to the Permitted Users field from "Admin approved users are pre-authorized" to "All users may self-authorize", or
• when using "All users may self-authorize" and the access token was revoked by the administrator or a time limit was set on the token.

From the docs under Permitted User Value "All users may self-authorize":

If the user has previously approved the app and the access hasn’t been revoked or expired, Salesforce performs a POST to the canvas app with a signed request payload.

If the user hasn’t approved the app, or if the access has been revoked or expired, Salesforce performs a GET to the canvas app URL. The canvas app must handle the GET by accepting the call and looking for the URL parameter _sfdc_canvas_authvalue. If the canvas app receives this parameter value, the canvas app should initiate the approve or deny OAuth flow.
_sfdc_canvas_authvalue = user_approval_required
After the OAuth flow is initiated and the user approves the app, the canvas app should call the repost() method with a parameter of true to retrieve the signed request.