A simple appengine-based facebook request signer

facebook.py

from google.appengine.ext import webapp
import md5

# XXX Facebook private application key
APP_KEY = "AAAAAAAAAAAAAAAAAAAAAAAAA"

class FacebookRequestSigner(webapp.RequestHandler):
    def get(self):
        method = self.request.get("method")

        # Only sign createToken/getSession requests
        if (method != "auth.getSession" and method != "auth.createToken"):
            self.error(401)
            self.response.out.write("Can not sign method %s" % method)
            return

        # Compute the signature 
        canonical = ""
        for key in sorted(self.request.arguments()):
            canonical += "%s=%s" % (key, self.request.get(key))

        canonical += APP_KEY
        digest = md5.new(canonical.encode("utf-8"))

        self.response.headers['Content-Type'] = 'text/plain'
        self.response.out.write(digest.hexdigest())