Kdyby/Facebook — pull request #22 by MartinMystikJonas (2014-10-09 07:01:04+00:00)
Title: Option to not provide appsecret_proof in API request

There are use cases when we do not want to provide appsecret_proof in request.

One example is validation of access_token generated ba different application.

Validation is possible by checking access token owner:
https://graph.facebook.com/me?access_token=CAAHT1drGwlkBANZCnXNXTFzEvyVGKU89z0n0PMrnZCZCZB2VYL3YgTqhcwrSPGCCXDBZBKEfeDvrkJBgnkJhFo87IWFwTZAXU2SJ6GerYg4JnHgLt3NzqhFvNaFmBa7xzcf124UcZAFBJ0mEOef1ZAZAb7z8vJLLU2tyFL5DCOkciZCXLXWemU3awjJNZB8GaLq81MtpB50ilXJxIs9x4xlUQFQ

But when appsecret_proof is provided it ends by error "Invalid appsecret_proof provided in the API argument" if original token is generated by different app.

We use this to prove user is logged in mobile app when accessing our application API.