Q:

Facebook decoded signed_request contains extra data which isn't mentioned in the documentation

I have a Facebook signed_request which is received by subscribing to the auth.login event  and after the user logs in using the facebook login button
After I decode the signed_request I have the following information in it:
{'issued_at': 1318492701, 
'code': 'AQCXI5aiyYtYLFNtkYhtKwDhO02lP[truncated]', 
'user_id': '100000xxxxxxxxx', 
'algorithm': 'HMAC-SHA256'}

I cannot find in the signed_request documentation.  What is this code and what's its use? 
I thought it might be used to obtain an authorization code as stated in this thread but along with the signed_request I also receive an access token for the user in the response from the login event. 

A:

This is the signed_request from the JavaScript SDK, right?  The code is used by the SDK but isn't for the Server-side Authentication.  Actually, we will update the documentation to reflect the signed_request behaviors.