Facebook data deletion callback gives "Unable to confirm request was received"

Question

I just convert PHP sample code to C#. This is my endpoint:

   public async Task<IHttpActionResult> Delete([FromBody] FbModel fbModel)
    {
        var res = fbModel.signed_request.Split(new char[] { '.' }, 2);
        var secret = "ababababababababababababa";
        if (res.Length > 1)
        {
            var sig = res[0];
            var json = base64decode(res[1]);
            var data = Newtonsoft.Json.JsonConvert.DeserializeObject<FacebookDeletionDto>(json);

            if (string.IsNullOrEmpty(data.algorithm) || data.algorithm.ToUpper() != "HMAC-SHA256")
                throw new Exception("Unknown algorithm:" + data.algorithm + ". Expected HMAC-SHA256");

            var expected_sig = hmacSHA256(res[1], secret);

            if (expected_sig != sig)
                throw new Exception("Invalid signature:" + sig + ".  Expected" + expected_sig);     

            var returnJson = new { Url = $"https://myperfectsite.com/fb/info/{data.user_id}", confirmation_code = $"{data.user_id}" };

            return Ok(returnJson);
        }
        return null;
    }

This code running perfectly and gives me json. My endpoint return URL and confirmation code in JSON. But in facebook confirmation page it gives me this error :"Unable to confirm request was received "App name" sent an invalid response to your request. Contact "App name" directly to request it delete info it has about you."

Answer 1

Facebook provides only the following info:

Return a JSON response that contains a URL where the user can check the status 
of their deletion request and an alphanumeric confirmation code. 
The JSON response has the following form:

{ url: '<url>', confirmation_code: '<code>' }

I ran into the same problem where FB would not accept our server response. We ultimately fixed the problem by outputting the JSON response in EXACTLY the same sample format. Property names lowercase and not quoted, single quotes around the values, and a value that was alphanumeric (no symbols) and not too long (20 char length worked).

EDIT: Looking back at it, looks like we also used a dynamic type for the response.

        dynamic response = new ExpandoObject();
        response.url = "<url>";
        response.confirmation_code = "<code>";
        return response;