Facebook REST api Application Secret

Question

I'm trying to retrieve a list of my friends' birthdays using the following code. I'm using Facebook's FQL method using the old REST API.

<?php 
  $appapikey = '<app api key>';
  $appsecret = '<app secret>';
  $token = 'access_token=<token>';
  $fql = "SELECT uid, first_name, last_name, birthday, sex, proxied_email FROM standard_user_info WHERE uid = <my uid>";

  $fqlqueryuri = 'https://api.facebook.com/method/fql.query?query='.urlencode($fql).'&amp;'.$token.'&amp;application_secret='.$appsecret;
  $fqlquery = htmlentities(file_get_contents($fqlqueryuri));
  echo "<pre>" . $fqlquery . "</pre>";
?>

When I run the query I get the following error;

<?xml version="1.0" encoding="UTF-8"?>
<error_response xmlns="http://api.facebook.com/1.0/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
  <error_code>15</error_code>
  <error_msg>The method you are calling or the FQL table you are querying cannot be called using a session secret</error_msg>
  <request_args list="true">
    <arg>
      <key>method</key>
      <value>fql.query</value>
    </arg>
    <arg>
      <key>query</key>
      <value>SELECT uid, first_name, last_name, birthday, sex, proxied_email FROM standard_user_info WHERE uid = xxx</value>
    </arg>
    <arg>
      <key>access_token</key>
      <value>xxx</value>
    </arg>
    <arg>
      <key>application_secret</key>
      <value>xxx</value>
    </arg>
  </request_args>
</error_response>

Having looked on Facebook for a more detailed error description, I came across this one liner; 15 - API_EC_SESSION_SECRET_NOT_ALLOWED - This method call must be signed with the application secret (You are probably calling a secure method using a session secret)

I thought I had signed the code with the application secret. I am running this offline and have the correct permissions for it to do so.

Any ideas?!

Answer 1

You don't directly pass the application secret. You're supposed to use it to generate a signature and send that. See http://wiki.developers.facebook.com/index.php/How_Facebook_Authenticates_Your_Application and http://wiki.developers.facebook.com/index.php/Verifying_The_Signature