EDIT: Kavya: how does the FB server recognize my localhost even without an IP or port??
I don't think this has anything to do with Facebook, I guess since the iframe src parameter is loaded from client-side it'll treat your local URL as if you put it directly on your browser.
For example have a file on your online server with content (e.g. online.php):
And on your localhost root directory, have the file test.php:
<?php echo "Hello from Localhost!"; ?>
Now visit http://your_domain.com/online.php you will see your localhost file's content!
This is why realtime subscriptions and deauthorize callbacks (just to mention) won't work with localhost URLs! because Facebook will ping (send http requests) to these URLs but obviously Facebook server won't translate those URLs to yours!
So I got this to work today. My URL is http://localhost:8888. The domain I gave facebook is localhost. I thought that it was not working because I was trying to pull data using the FB.api method. I kept on getting an "undefined" name and an image without a source, so definitely didn't have access to the Graph.
Later I realized that my problem was really that I was only passing a first argument of /me to FB.api, and I didn't have a token. So you'll need to use the FB.getLoginStatus function to get a token, which should be added to the /me argument.
You can also edit 'hosts' file and create local variation of your domain.
Example
If your real facebook application address is "example.com" you can create "localhost.example.com" (accessible only from your pc) domain in your "hosts" file pointing to "localhost" and run your local website under this domain.
You can trick Facebook this way.
Use "Site URL:" and "Mobile Site URL:" to hold your production and development URLs. Both sites will be allowed to authenticate. I'm just using Facebook for authentication so I don't need any of the mobile site redirection features. I usually change the "Mobile Site URL:" to my "localhost:12345" site while I'm testing the authentication, and then set it back to normal when I'm done.
Facebook allows only one domain for App at the time. If you are trying to add another one, as localhost, it will show some kind of different error about domain. Be sure to use only one domain for callback and for app domain setting at the time.
With this command, we will be both creating the self-signed SSL certificate and the server key that protects it, and placing both of them into the new directory.
The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address.
Common Name (e.g. server FQDN or YOUR name) []:example.com or
localhost
Step Four—Set Up the Certificate
sudo vim /etc/apache2/sites-available/default-ssl
Find following lines and edit those with your settings
ServerName localhost or example.com
SSLEngine on SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
Step Five—Activate the New Virtual Host
sudo a2ensite default-ssl
sudo service apache2 reload
Use MAMPPRO and create:
server name: the EXACT adress of you website (eg: helloworld.com)
to your site on your disk
On Facebook:
So you can keep your original Site URL as well (eg: helloworld.com)
Now you understand that when you type your website on the adress bar you are in local!
..and when you want to be online, just inactive the server on MAMP PRO..
Ok I'm not sure what's up with these answers but I'll let you know what worked for me as advised by a senior dev at my work. I'm working in Ruby on Rails and using Facebook's JavaScript code to get access tokens.
Problem: To do authentication, Facebook is taking the url from your address bar and comparing that with what they have on file. They don't allow you to use localhost:3000 for whatever reason. However, you can use a completely made-up domain name like yoursite.dev by running a local server and pointing yoursite.dev to 127.0.0.1:3000 or wherever your localhost was pointing to.
Step 4: Edit your hosts file, in /etc/hosts on Mac to include
127.0.0.1 yoursite.dev
This file directs domains to localhost. Nginx listens in on localhost and redirects if it matches a rule.
Step 5: Every time you use your dev environment going forward, you use the yoursite.dev in the address bar instead of localhost:3000 so Facebook logs you in correctly.
It's probably not ideal as Dynamic IP's change and one could probably use DynDNS or something similar to make the IP more "static" but it worked for me
In my case the issue revealed to be chrome blocking the CORS request from localhost:4200 to facebook api website.
Running Chrome with this setting: "YOUR_PATH_TO_CHROME\Google\Chrome\Application\chrome.exe" --disable-web-security --user-data-dir="c:/chrome
worked like a charm while developing. Even with no localhost added to facebook app's settings.