In this video, it mentioned not to embed the Facebook secret key inside the application, http://www.adobe.com/devnet/facebook/articles/video_facebook_quick_start.html, so I passed null to this function
facebookSession = new FacebookSessionUtil(MYAPI, null, stage.loaderInfo);
but it didn't work. How can I hide my secret key?
In the doc it mentioned:
http://facebook-actionscript-api.googlecode.com/svn/release/current/docs/com/facebook/utils/FacebookSessionUtil.html
secret:String — Your application's secret key. If this parameter is passed a value of null, the constructor looks for a special session secret stored in the fb_sig_ss property of the loaderInfo object. For web sessions, even if you pass a non-null value for this parameter, the constructor will always look for a session secret and use that instead of the value that you pass for this parameter.