gistfile1.java

String signed_request = "-BcQzSUqk_dIsNtuurd4kawKsrO2J_WqyL7vDteT3yU.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImV4cGlyZXMiOjEzMTI5OTkyMDAsImlzc3VlZF9hdCI6MTMxMjk5NDY0OCwib2F1dGhfdG9rZW4iOiIxODM4OTk2NzUwMTEzMDN8Mi5BUUNKX2Y3NlJWamlRQ2FDLjM2MDAuMTMxMjk5OTIwMC4xLTUxMzA1MDY4NnxfYXduR2NoaUdsMkkyNXFOQlpHREpYNnhrdmciLCJ1c2VyIjp7ImNvdW50cnkiOiJ1cyIsImxvY2FsZSI6ImVuX1VTIiwiYWdlIjp7Im1pbiI6MjF9fSwidXNlcl9pZCI6IjUxMzA1MDY4NiJ9";

String rawpayload = signed_request.split("\\.")[1];
String signature = signed_request.split("\\.")[0].replace("-", "+").replace("_", "/").trim();
String facebookSecret = "3035c2fd47ddbff344d55fb878d2cfa7";

BASE64Decoder decoder = new BASE64Decoder();

//Ouput payload
System.out.println(new String(decoder.decodeBuffer(rawpayload.replace("-", "+").replace("_", "/").trim())));

//Check signature
SecretKey key = new SecretKeySpec(facebookSecret.getBytes(), "HMACSHA256");
Mac m = Mac.getInstance("HMACSHA256");
m.init(key);
byte[] mysig = m.doFinal(rawpayload.getBytes());

//hack for extra character =(
byte[] trimmed = decoder.decodeBuffer(signature);
trimmed = Arrays.copyOf(trimmed,trimmed.length-1);

System.out.println(Arrays.equals(mysig,trimmed));