X-Purpose: preview

Facebook App Browser

[lucy24]

If this isn't the best place to ask, I'm sure someone will tell me.

Can someone who knows Facebook shed a little light on this behavior? It's got something to do with the Facebook app; for site-specific reasons this is the first time I've noticed it, though it isn't new.

After the usual FB stuff, there are vast numbers of robotic requests citing some form of
m.facebook.com
as referer. IP and UA seem to be human, from all over the map. (In the specific case that prompted the question, “all over the map” actually means all over, hm, let’s call it Barsetshire, while UA mostly means iOS.)

All of these requests are blocked on header grounds, but a handful of them are immediately followed by a human request from the same IP-and-UA combo. Another handful of human requests come in without the preceding robotic visit.

Poring over headers, I find a slew of robot stuff--minus two ordinary human headers, which is why they all got blocked--and in particular

X-Purpose: preview

Query: If the request had not been blocked, would it have been followed-up by requests for all supporting files including many MB of images? If so, I'm glad it was blocked, since it doesn't seem to have prevented humans from following the link.

Tangentially, I was bemused to note that people in the UK--or, at least, people in Barsetshire--are inordinately fond of iOS, both Pad and Phone, to the near-exclusion of Android. Never knew that.

[keyplyr]

Even though FB has denied this publically multiple times, IMO they allow certain 3rd party bots to crawl all our accounts to gather data. I see too much of this for it to be accidental.

What you describe seems (in part) to be one of the many bots connecting to your site through the m.facebook.com mobile portal & collecting data at the same time humans are using the FB app. The bot connects faster than the human driving the app.

This only happens on mobile. The "preview" is cause by the FB app browser view. Same header for the Twitter app browser view. The user can choose to leave the app browser and view the page with their default browser, and the header will the appear normal.

[wilderness]

lucy,
had one of these refers recently. Copy and pasted the URL into my browser while I was FB active.
And it took me to a scaled down version of my Home page.
Many FB users are using many different types of devices (wouldn't surprise me if somebody was using a Timex Sinclair or a transistor radio). I only use a desktop. My view offers three columns of display and your refer is the main column only (no ads or other navigational panels (there is a pull down panel at page top in this view) of this HOME page..
My FB activity is limited to two groups where widgets are the primary topic. When I login to one group. three page options are displayed 1) personal page 2) Home page (recent posts by friends or others you may be following) and the Group options.
My focus is widgets. Never post anything on my personal page, and rarely view the HOME page (too much non-widgets).
Thus depending upon YOUR FB Friends activity the refer could be anything and even come form another FB user (friend of a friend) you don't even know or communicate with.

keyplr,
Most FB users never take the time to explore their configuration options (doubt most are even aware of the 3d party bots). There are only a few options for users whether configuration or participation.
FB offers all users an option to turn off 3rd party bots, which I did immediately upon registration.

[keyplyr]

wilderness - it's in the *app* not on FB

[wilderness]

thanks. Don't use apps. from FB or any other handheld. Don't even use them on my handheld (er phone, never used for www).

[dstiles]

I've been logging "purpose" for a few years now, but haven't seen fit to block it. In fact, haven't paid it much attention since setting it up.

Looking at the trap source code, I check for three bowser types: AppleWebKit, Safari a, Gecko Chrome (although, as you say, they are all iphone). Content for X_Purpose I have as Instant, Preview or Unknown.

So far this month I have logged 7 instances, all facebook to two popular sites and each to an expected page. All hits were singles and from domestic IPs - 5 UK, one Romania and one Italy (I'm in UK).

[lucy24]

Thus depending upon YOUR FB Friends activity

I don't have any FB friends ... because I'm not on FB ;) These are pages that someone else put up a link to; before all those robots there was the usual FB stuff where they fetch the page and all its supporting files. The exact format of the FB app UA string varies, but it's always recognizable as the app. Goodness, what a lot of people in Barsetshire* use iPads.

And it took me to a scaled down version of my Home page.

The part I'd like to be certain about is whether all those blocked requests are happening in the background, invisible to the human, or whether they are all humans who attempted to view the page and weren't let in. Well, except the ones who were clever enough to detour to their browser. I took it as robotic because my 403 page has supporting files--it's how I identify blocked humans--and these supporting files weren't requested.

:: detour to re-check logged headers ::

By far the most common use of "X-Purpose" (in my case, always "preview") is from the FB app, but now that I look again I do see random others with ordinary desktop UAs. In fact they all seem to be Safari (that is, specifically Safari, not Chrome or other webkit that also has Safari in the UA string), and all without a referer. Is it that annoying thing where you open the browser and it shows thumbnails of your most recently visited pages? I think Safari re-requests the page when doing so, while Firefox uses the cached version. But to find out for sure I'd have to do some careful cross-searching, and here I'm really asking about the FB app.

:: final check ::

Criminy. Based purely on the size of yesterday's final log file, the entire population of Barsetshire must have requested this page. Even the size of the header log--generally fairly constant, as I don't log non-page requests--is twice as big as usual. I do hope they all enjoyed themselves.


* The page in question is an 1869 coffee-table book called, let's say, Great Houses of Barsetshire. It even drew the attention of an all-things-barsetshire WP site's robot.

[wilderness]

"I don't have any FB friends ... because I'm not on FB "

lucy,
Wasn't implying that you had any friends (FB or otherwise) LOL, rather that the individual FB user has no control over what appears on that page.
There are but two ways to not see content on this page from another user.
1) Unfollow
2) BLOCK (prevent both yourself and blocked party from seeing each others content)