Getting a Facebook OAuth problem with HTTP referer

Question

I got an email today saying:

In every case that we have examined, this information is passed via the HTTP Referer Header by the user's browser. This can happen when using our legacy authentication system and including , or content from 3rd parties in the page that receives authentication data from Facebook. Our legacy mechanism passes authentication information in the URL query string which, if handled incorrectly, can be passed to 3rd parties by the browser. Our current OAuth 2.0 authentication system, released over a year ago, passes this information in the URL fragment, which is not passed to 3rd parties by the browser.

I'm a bit confused as the way I have integrated is using the PHP API using a similar response as per the example.php file:

https://github.com/facebook/php-sdk

Here is how I'm making the request:

$facebook = new Facebook(array(
    'appId'  => FACEBOOKAPPID,
    'secret' => FACEBOOKSECRET,
    'cookie' => false,
));
$fb_session = $facebook->getSession();
$fb_me = null;
// Session based API call.
if ($fb_session) {
    try {
        $fb_uid = $facebook->getUser();
        $fb_me = $facebook->api('/me');
        $fb_me['photo'] = 'http://graph.facebook.com/'.$fb_uid.'/picture?type=large';
        $_SESSION['register_api'] = 1;
        $_SESSION['register_api_details'] = $fb_me;
        $_SESSION['register_api_user_id'] = $fb_uid;
        header_redirect(SITEURL.'/register');
    } catch (FacebookApiException $e) {
        error_log($e);
    }
}
else{
    # LOGIN URL FOR FACE BOOK & request extra stuff
    $fb_login_url = $facebook->getLoginUrl(array('req_perms'=>'email,user_about_me,user_birthday,user_website'));
    header_redirect($fb_login_url);
}

Everything is working fine, but I don't understand what I am doing wrong. As far as I was aware, I am using OAuth.

Answer 1

It turns out that they were just about to release a new version of the API which solved this problem.