oyvindkinsey/facebook-php-sdk — comment on commit 3598635c1a3e9dc2eb4f8c74d115e5f98a9fc546
File:  line 0
By oyvindkinsey:

I'm going to have to make some changes in order to expose and make clear that there is a distinction between validating a signed_request and also checking that its age is not to old (would you trust a signed_request from last year?), and actually using the access_token (directly or via code) to verify its validity.

For most use cases a fresh signed_request will be enough and simply having a argument '$validate' which runs a /me will probably be enough.