{"action":"closed","issue":{"url":"https://api.github.com/repos/yiisoft/yii2-authclient/issues/67","repository_url":"https://api.github.com/repos/yiisoft/yii2-authclient","labels_url":"https://api.github.com/repos/yiisoft/yii2-authclient/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2-authclient/issues/67/comments","events_url":"https://api.github.com/repos/yiisoft/yii2-authclient/issues/67/events","html_url":"https://github.com/yiisoft/yii2-authclient/issues/67","id":119384532,"number":67,"title":"Securing Graph API Requests","user":{"login":"blackhpro","id":4411541,"avatar_url":"https://avatars.githubusercontent.com/u/4411541?v=3","gravatar_id":"","url":"https://api.github.com/users/blackhpro","html_url":"https://github.com/blackhpro","followers_url":"https://api.github.com/users/blackhpro/followers","following_url":"https://api.github.com/users/blackhpro/following{/other_user}","gists_url":"https://api.github.com/users/blackhpro/gists{/gist_id}","starred_url":"https://api.github.com/users/blackhpro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blackhpro/subscriptions","organizations_url":"https://api.github.com/users/blackhpro/orgs","repos_url":"https://api.github.com/users/blackhpro/repos","events_url":"https://api.github.com/users/blackhpro/events{/privacy}","received_events_url":"https://api.github.com/users/blackhpro/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-11-29T20:17:21Z","updated_at":"2016-04-11T10:03:34Z","closed_at":"2016-04-11T10:03:34Z","body":"Hi.\r\nI do not know whether there was raised the question but I want to ask it.\r\n\r\nWhen using Facebook ```php yii\\authclient\\clients\\Facebook``` sometimes an error occurs\" api calls from the server require an appsecret_proof argument \". It occurs on facebook if not passed mandatory parameter appsecret_proof.\r\nIf you enable additional security check.\r\nHere it is written in more detail - https://developers.facebook.com/docs/graph-api/securing-requests\r\n\r\nFix it pretty easy, you have already done in such class as the LinkedIn / VKontakte. It is enough to override a method Facebook :: apiInternal\r\nadding\r\n\r\n```php\r\nprotected function apiInternal($accessToken, $url, $method, array $params, array $headers)\r\n{                \r\n    $params['appsecret_proof'] = hash_hmac('sha256', $accessToken->getToken(), $this->clientSecret);        \r\n    return $this->sendRequest($method, $url, $params, $headers);\r\n}\r\n```\r\n\r\nIs it possible to use the safety appsecret_proof without making any changes to class oAuth client?"}}