Authorization iframe applications VKontakte

Question

Ruby on Rails

The problem is this - the iframe application receives a token from VKontakte, but it is valid only when working with the JS API through the browser. When I try to use the API from the server, I get an IP address mismatch message. The

question is - what is the correct way to pull the API from the server in an iframe application? Do you need authorization for the site? Or only JS is supposed to be used?

What is "application server authorization?" - Is it possible to make requests to obtain information about the current user only with the help of it?

PS I use gem vkontakte_api

Answer 1

Recently I struggled with it, regarding iframe applications: the correct (from the point of view of VK method) is jsonp. Then a little code and your server will receive everything it needs through the client.
Authorization of the application server - a little bit different, you can get very limited opportunities to influence users who are already using your application (send them a message, alert, count the number).
In order for the server to reach a specific user, you need to register a stand-alone application and authorize the user through your server (using powerful magic to bypass vkontaktik protection). This method, although it makes it possible to manage almost all available to the user, is incorrect. It must be used thoughtfully and without fanaticism - otherwise VK will protect itself from you by blocking all your applications, and maybe you.

Answer 2

There are server requests in the api, they do not require user authorization, but there are not many of them. They are determined by typing (any request, like wall.get, we try - it turns out, it means it is available as a server one)
To use a secret key is enough.

$VK = new vkapi($api_id, $secret_key);
$resp = $VK->api('wall.get', array('extended' => 1,'owner_id' => '-' . $gid, 'offset' => 0, 'count' => 5));
 foreach ($resp['response']['wall'] as $photo) {
...