Can’t load URL: The domain of this URL isn’t included…

So… I have been struggling to get this plugin to work on facebook. Getting the dreaded

Can’t load URL: The domain of this URL isn’t included in the app’s domains. To be able to load this URL, add all domains and sub-domains of your app to the App Domains field in your app settings.

message.

After struggling for about an hour I tried something stupid… I added my http:// URL to the “Valid OAuth redirect URIs” in my Facebook application settings. And guess what it worked!

My site is entirely https:// so I never expected that the plugin might be doing OAuth redirects from the insecure protocol (frankly I am surprised that Facebook allows this).

So, here is what I have found so far (and I haven’t even used the plugin yet… this is just from trying to set it up)

1. The plugin is switching from secure https:// to insecure http:// to do the redirects to Facebook. It should not be doing that. This leads to a whole lot of other problems that are impossible to workaround without switching https:// off for the site – which nobody is going to do for a plugin!
2. The second problem is a consequence of the decision to to switch from https:// to http:// to do the redirect to Facebook. After authorising the plugin (more on that later), Facebook returns to http:// instead of https:// where the admin is logged in. WordPress is not able to share a login session between secure https:// and insecure http:// protocols, so the Facebook return returns to 1)a WordPress that does not have an admin session logged in and 2)a web server trying to enforce an https:// site protocol; and one ends up with a WordPress White Page of Death as everything fall apart.
3. So, even though Facebook successfully did the authorisation, the plugin did not receive the token because facebook tried to return the token to the http:// site, when the plugin was running on the https:// site.
4. The permission request on Facebook is so broad… that I get a Facebook popup saying:
   

   Submit for Login Review
   Some of the permissions below have not been approved for use by Facebook.
   Submit for review now or learn more.

5. The permissions requested by the plugin are:
   

   Access your public profile, Friends list, Timeline posts, relationships, relationship interests, date of birth, work history, status updates, education history, events, home town, current city, photos, religious and political views, videos, website, personal description, likes, tagged places, email address and games activity, post to Facebook for you, manage your ads, access your Facebook ads and related stats; Manage your business; Access the groups you manage, manage your Pages, manage call to action on your Pages, manage Instant Articles for your Pages, send messages from Pages you manage, use a user phone number to send messages from Pages you manage, send messages from Pages you manage at any time after the first user interaction, show a list of the Pages you manage, publish as Pages you manage, access your Facebook Pages’ messages and manage your events.

   All I want is for the plugin to post to my Facebook Pages, and that is the one permission that the plugin does not request (if it did, Facebook would have shown another popup with the list of Facebook pages that I manage so that I can select which page I want to give permission for the plugin to post to)