Supposedly, I can get an Atom feed of my Facebook Activity Stream by issuing an HTTP request with a specific set of url arguments. That's documented by Facebook, as I laid out earlier. So if I try a request with the signature created like so:

createFetchSignatureFor: secretHolder inSession: session

	"create the signature argument"



	| stream |

	stream := WriteStream on: String new.

	stream nextPutAll: 'app_id=', secretHolder applicationId.

	stream nextPutAll: 'session_key=', session key.

	stream nextPutAll: 'source_id=', session uid printString.

	stream nextPutAll: session secret.

	^(MD5 hash: stream contents) asHexString asLowercase

and the url created as follows:

getUrlWithSecret: secretHolder url: activityStreamUrl session: session



	| stream sigString |

	stream := WriteStream on: String new.

	stream nextPutAll: activityStreamUrl.

	sigString := self 

			createFetchSignatureFor: secretHolder 

			inSession: session.

	stream nextPut: $?.

	stream nextPutAll: 'source_id=' , session uid printString.

	stream nextPutAll: '&app_id=' , secretHolder applicationId.

	stream nextPutAll: '&session_key=' , session key.

	stream nextPutAll: '&sig=' , sigString.

	^stream contents

I get back a 403, telling me: "HTTP/1.1 403 Forbidden: Lacking extended permission"

Which is incorrect; I know my app has the appropriate permissions. If I add the optional arguments:

getUrlWithSecret: secretHolder url: activityStreamUrl session: session



	| stream sigString |

	stream := WriteStream on: String new.

	stream nextPutAll: activityStreamUrl.

	sigString := self 

			createFetchSignatureFor: secretHolder 

			inSession: session.

	stream nextPut: $?.

	stream nextPutAll: 'source_id=' , session uid printString.

	stream nextPutAll: '&app_id=' , secretHolder applicationId.

	stream nextPutAll: '&session_key=' , session key.

	stream nextPutAll: '&sig=' , sigString.

	stream nextPutAll: '&v=0.7'.

	stream nextPutAll: '&read'.

	^stream contents

I instead get a 401: HTTP/1.1 401 Unauthorized: Invalid 'sig' signature

Which I'm not understanding, as I follow the process Facebook specifies. Anyone worked with this before know what I'm doing wrong, or is this a Facebook bug? I'm leaning that way, based on this forum post I found...

Technorati Tags: facebook, social media