title: Facebook web application extended permissions second step dont show
body: <p><strong>Update2</strong>
  This post is getting old but still relevant.. Below is whe way I solved it. I marked the other guys answer because I think it answers the question better. I'm calling a similar method(I'am about to refactor:)) in accountcontroller. The string should be a list... I think you get it.</p>
  <pre><code>/// &lt;summary&gt;
      /// Use this method when an action fails due to lack of priviligies. It will redirect user to facebook with provided permission request.
      /// Refactor to handle list of request.
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;permission&quot;&gt;&lt;/param&gt;
      private static void AddAdditionalPermissions(string permission)
      {
          System.Diagnostics.Trace.TraceInformation(permission + &quot; not authorized for user.&quot;);
          string facebook_urlAuthorize_base = &quot;https://graph.facebook.com/oauth/authorize&quot;;
          string scope = permission; //see: https://developers.facebook.com/docs/authentication/permissions/ for extended permissions
          string urlAuthorize = facebook_urlAuthorize_base;
          urlAuthorize += &quot;?client_id=&quot; + AppId;
          urlAuthorize += &quot;&amp;redirect_uri=&quot; + &quot;https://fbd.anteckna.nu/&quot;;
          urlAuthorize += &quot;&amp;scope=&quot; + scope;
  
          //redirect the users browser to Facebook to ask the user to authorize our Facebook application
          HttpContext.Current.Response.Redirect(urlAuthorize, true); //this cannot be done using WebRequest since facebook may need to show dialogs in the users browser
      }
  </code></pre>
  <p>Then every method making a call to facebook like /me/home with facebok C# SDK catches FacebookOAuthException and redirects to the folling method. This is how we apply the best practise of not asking permissions from users up front but when needed. This method should have  aredirect url that matches as well but we've just get going :)</p>
  <p>Hope it helps!</p>
  <pre><code>/// &lt;summary&gt;
      /// Check for what permissions to request or different ways to handle FacebookOAuthExceptions.
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;foae&quot;&gt;The exception object&lt;/param&gt;
      public static void HandleAuthorizationsExceptions(FacebookOAuthException foae)
      {
          if (foae.Message.Contains(&quot;publish_permissions&quot;))
          {
              AddAdditionalPermissions(&quot;publish_permissions&quot;);
          }
          else if (foae.Message.Contains(&quot;read_stream&quot;))
          {
              AddAdditionalPermissions(&quot;read_stream&quot;);
          }
          else
          {
              System.Diagnostics.Trace.TraceError(&quot;Unhandled error at:&quot; + foae.StackTrace);
          }
      }
  </code></pre>
  <p><strong>Update</strong>: This behaviour is caused by .Net oauth implementation which has the scope hard coded in a sealed class. Added figure 4 to show the request parameter where the lack of additional scopes besides &quot;email&quot;(which is sent with all requests by .net oauth provider). Adding &quot;,publish_stream&quot; to the query string gives me the wanted behaviour. Anyone knows how to achieve this?</p>
  <p>Please do not submit answers or comments about facebook best practices or alternative solutions. I have an alternative solution but would like this to work with default registerfacebookclient parameters. I have updated the application to oly use publish_stream according to the two answers specifying on what permissions I'm asking for.</p>
  <p>figure 4<img src="https://i.stack.imgur.com/LZYSa.png" alt="Image showing scope parameter in query string" /></p>
  <p><strong>Original question:</strong>
  I'm setting up an application (C#.Net4.5 MVC4, razor views) which need pretty much all available user permissions from facebook.
  You can see code examples below how I have set it all up.</p>
  <p>The problem is that when clicking &quot;okay&quot; in figure 1, Facebook sends me back to my application. As I understand there should be an additional screen(figure2) asking for the &quot;heavier&quot; permissions. As of now I only get the permissions stated in figure one. That part works...</p>
  <p>Figure 1
  <img src="https://i.stack.imgur.com/1jjAm.png" alt="Facebook permissions dialog C#" /></p>
  <p>Figure 2
  <img src="https://i.stack.imgur.com/yhABz.png" alt="enter image description here" /></p>
  <p>So, using basic
  AuthConfig.cs</p>
  <pre><code>var facebooksocialData = new Dictionary&lt;string, object&gt;();
              facebooksocialData.Add(&quot;scope&quot;, &quot;email,publish_stream,read_stream,publish_actions,manage_pages,create_event,offline_access&quot;);
              OAuthWebSecurity.RegisterFacebookClient(
                  appId: &quot;165359673639901&quot;,
                  appSecret: &quot;15091cb2094a1996ae6c7b324f0300e6&quot;,
                  displayName: &quot;Facebook&quot;,
                  extraData: facebooksocialData);
  </code></pre>
  <p>This is how I handle the response but here facebook has not prompted the user for the extended permissions but only for email,</p>
  <p>AccountController.cs</p>
  <pre><code> //
          // GET: /Account/ExternalLoginCallback
  
          [AllowAnonymous]
          public ActionResult ExternalLoginCallback(string returnUrl)
          {
              AuthenticationResult result = OAuthWebSecurity.VerifyAuthentication(Url.Action(&quot;ExternalLoginCallback&quot;, new { ReturnUrl = returnUrl }));
              if (!result.IsSuccessful)
              {
                  return RedirectToAction(&quot;ExternalLoginFailure&quot;);
              }
  
              // Save the accesstoken into session
              Session[&quot;accesstoken&quot;] = result.ExtraData[&quot;accesstoken&quot;];
              Session[&quot;id&quot;] = result.ExtraData[&quot;id&quot;];
  
              if (OAuthWebSecurity.Login(result.Provider, result.ProviderUserId, createPersistentCookie: false))
              {
                  return RedirectToLocal(returnUrl);
              }
  
              if (User.Identity.IsAuthenticated)
              {
                  // If the current user is logged in add the new account
                  OAuthWebSecurity.CreateOrUpdateAccount(result.Provider, result.ProviderUserId, User.Identity.Name);
                  return RedirectToLocal(returnUrl);
              }
              else
              {
                  // User is new, ask for their desired membership name
                  string loginData = OAuthWebSecurity.SerializeProviderUserId(result.Provider, result.ProviderUserId);
                  ViewBag.ProviderDisplayName = OAuthWebSecurity.GetOAuthClientData(result.Provider).DisplayName;
                  ViewBag.ReturnUrl = returnUrl;
                  return View(&quot;ExternalLoginConfirmation&quot;, new RegisterExternalLoginModel { UserName = result.UserName, ExternalLoginData = loginData });
              }
          }
  </code></pre>
  <p>The closest to an answer I could find was a wp plugin which had the same issue. Their problem was solved by setting domain to localhost. This is how my application is set up.</p>