Methods to deal with FB Signed Requests

gistfile1.rb

# see https://github.com/ptarjan/base64url/blob/master/ruby.rb
def base64_url_decode(str)
  str += '=' * (4 - str.length.modulo(4))
  Base64.decode64(str.gsub("-", "+").gsub("_", "/"))
end

# see http://developers.facebook.com/docs/authentication/signed_request/
def valid_facebook_signature?(signature, encoded_data)
  base64_url_decode(signature) == HMAC::SHA256.digest(FACEBOOK_APP_SECRET, encoded_data)
end

# see http://developers.facebook.com/docs/authentication/fb_sig/
def valid_legacy_facebook_signature?
  str = ''
  fbsig = {}
  params.each_pair do |key, value|
    key = key.to_s
    if key =~ /^fb_sig_/
      fbsig[key[7,key.size]] = value
    end
  end
  fbsig.to_a.sort.each do |kv|
    str << "#{kv[0]}=#{kv[1]}"
  end
  str << FACEBOOK_APP_SECRET
  Digest::MD5.hexdigest(str) == params[:fb_sig]
end