0
@@ -36,7 +36,11 @@ module Facebooker
0
       private
0
       
0
       def session_already_secured?
0
-        (@facebook_session = session[:facebook_session]) && session[:facebook_session].secured?
0
+        (@facebook_session = session[:facebook_session]) && session[:facebook_session].secured? if valid_session_key_in_session?
0
+      end
0
+      
0
+      def valid_session_key_in_session?
0
+       !session[:facebook_session].blank? && (facebook_params[:session_key].blank? || session[:facebook_session].session_key == facebook_params[:session_key])
0
       end
0
       
0
       def secure_with_token!

0
@@ -529,7 +529,7 @@ module Facebooker
0
       end
0
       
0
       def fb_prompt_permission(permission,callback=nil)
0
-        raise (ArgumentError, "Unknown value for permission: #{permission}") unless VALID_PERMISSIONS.include?(permission.to_sym)
0
+        raise(ArgumentError, "Unknown value for permission: #{permission}") unless VALID_PERMISSIONS.include?(permission.to_sym)
0
         args={:perms=>permission}
0
         args[:next_fbjs]=callback unless callback.nil?
0
         tag("fb:prompt-permission",args)

0
@@ -290,11 +290,26 @@ class RailsIntegrationTest < Test::Unit::TestCase
0
   
0
   def test_existing_secured_session_is_used_if_available
0
     session = Facebooker::Session.create(ENV['FACEBOOK_API_KEY'], ENV['FACEBOOK_SECRET_KEY'])
0
+    session.secure_with!("c452b5d5d60cbd0a0da82021-744961110", "1111111", Time.now.to_i + 60)
0
+    get :index, example_rails_params_including_fb, {:facebook_session => session}
0
+    assert_equal(1111111, @controller.facebook_session.user.id)
0
+  end
0
+
0
+  def test_facebook_params_used_if_existing_secured_session_key_does_not_match
0
+    session = Facebooker::Session.create(ENV['FACEBOOK_API_KEY'], ENV['FACEBOOK_SECRET_KEY'])
0
     session.secure_with!("a session key", "1111111", Time.now.to_i + 60)
0
     get :index, example_rails_params_including_fb, {:facebook_session => session}
0
+    assert_equal(744961110, @controller.facebook_session.user.id)
0
+  end
0
+
0
+  def test_existing_secured_session_is_used_if_available_and_facebook_params_session_key_is_nil
0
+    session = Facebooker::Session.create(ENV['FACEBOOK_API_KEY'], ENV['FACEBOOK_SECRET_KEY'])
0
+    session.secure_with!("a session key", "1111111", Time.now.to_i + 60)
0
+    get :index, example_rails_params_including_fb.merge("fb_sig_session_key" => ''), {:facebook_session => session}
0
+    
0
     assert_equal(1111111, @controller.facebook_session.user.id)
0
   end
0
-  
0
+
0
   def test_session_can_be_secured_with_auth_token
0
     auth_token = 'ohaiauthtokenhere111'
0
     modified_params = example_rails_params_including_fb