SpringSource/spring-social-facebook — pull request #72 by habuma (2013-02-08 23:15:18+00:00)
Title: SOCIALFB-110: Added signin controller to support Facebook Canvas applications.

Facebook Canvas applications do not follow a pure OAuth2 flow*. Therefore, although it is possible to make Spring Social's ProviderSignInController work with canvas apps, it is not optimal. This change introduces a CanvasSignInController that handles signin by accepting an access token from the signed_request parameter given to the application by Facebook.

* Actually, they do follow the OAuth2 Authorization Code Grant flow, but the flow is handled at the top-level...within Facebook itself. The actual canvas application, which is contained within an iframe at Facebook, is given the access token from Facebook via a POST to its canvas page URL and within a signed_request parameter.