Specifically for some POST requests in current implementation we get API calls from the server require an appsecret_proof argument response. Some POST endpoints will send the HTTP body with form encoded data, which would mean the body parameters are ignored.
Tangibly related it may be worth also implementing it following https://developers.facebook.com/docs/facebook-login/security/#proof (using timestamp in proof computation is not enforced but recommended by FB)
// See https://developers.facebook.com/docs/facebook-login/security/#proof
var appsecretTime = TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis());
final String appsecretProofPlain = accessToken + "|" + appsecretTime;
for (byte b : mac.doFinal(appsecretProofPlain.getBytes())) {
appsecretProof.format("%02x", b);
}
request.addQuerystringParameter("appsecret_proof", appsecretProof.toString());
request.addQuerystringParameter("appsecret_time", String.valueOf(appsecretTime));
Specifically for some POST requests in current implementation we get API calls from the server require an appsecret_proof argument response. Some POST endpoints will send the HTTP body with form encoded data, which would mean the body parameters are ignored.
Tangibly related it may be worth also implementing it following https://developers.facebook.com/docs/facebook-login/security/#proof (using timestamp in proof computation is not enforced but recommended by FB)