问题
What is meant by removal of fb_sig ? Is this migration reuqired for Iframe apps using fb_sig and old jssdk or for all apps , including the old FBML canvas apps using and relying on fb_sig post parameters as well ?
回答1:
Yes.
Fb_sig params will no longer be sent, so you have to switch to OAuth 2.0 for authentication and also to the signed_request param.
OAuth 2.0 and HTTPS Migration states "all Website and Canvas apps must exclusively support OAuth 2.0 (draft 20)" and "all Canvas and Page Tab Apps must use the signed_request parameter".
Also see the "Removing fb_sig" section of Developer Roadmap Update: Moving to OAuth 2.0 + HTTPS. While that post is from May, I've only seen confirmations since then that fb_sigs will be removed October 1st, and I've seen nothing to the contrary.
来源：https://stackoverflow.com/questions/7421709/are-fbml-apps-required-to-upgrade-to-oauth-access-token-by-october-1st