code: protected boolean verifySignedRequest(String appSecret, String algorithm, String encodedPayload, byte[] signature) {
      verifyParameterPresence("appSecret", appSecret);
      verifyParameterPresence("algorithm", algorithm);
      verifyParameterPresence("encodedPayload", encodedPayload);
      verifyParameterPresence("signature", signature);
  
      // Normalize algorithm name...FB calls it differently than Java does
      if ("HMAC-SHA256".equalsIgnoreCase(algorithm)) {
        algorithm = "HMACSHA256";
      }
  
      try {
        Mac mac = Mac.getInstance(algorithm);
        mac.init(new SecretKeySpec(toBytes(appSecret), algorithm));
        byte[] payloadSignature = mac.doFinal(toBytes(encodedPayload));
        return Arrays.equals(signature, payloadSignature);
      } catch (Exception e) {
        throw new FacebookSignedRequestVerificationException("Unable to perform signed request verification", e);
      }
    }
docs: Verifies that the signed request is really from Facebook.
  
  @param appSecret
  The secret for the app that can verify this signed request.
  @param algorithm
  Signature algorithm specified by FB in the decoded payload.
  @param encodedPayload
  The encoded payload used to generate a signature for comparison against the provided {@code signature}.
  @param signature
  The decoded signature extracted from the signed request. Compared against a signature generated from
  {@code encodedPayload}.
  @return {@code true} if the signed request is verified, {@code false} if not.