facebook/facebook-php-sdk — pull request #56 by kilotaras (2013-01-11 02:48:03+00:00)
Title: Fixing a vulnerability with signed_requests

See the following use case

1) Alice is logged into Facebook
2) Alice visits example.com/with_js_sdk.php (our PHP SDK example endpoint). The SDK will write her signed_request, user_id, and access_token to a session cookie.
3) Alice is then tricked into visiting example.com/with_js_sdk.php?signed_request={Bob's signed request}. The SDK will then set the user_id to Bob, while keeping Alice's access_token in persistent storage
4) If example.com has another endpoint that authenticates based on getUser(), Bob now has access to data returned by Alice's access_token.

This fixes it.