It's not clear if developers of many of the apps transmitting Facebook ID numbers even knew that their apps were doing so. The apps were using a common Web standard, known as a "referer," which passes on the address of the last page viewed when a user clicks on a link. On Facebook and other social-networking sites, referers can expose a user's identity.
From this article:
Sadly, all those parameters [identifying the Facebook user etc] go in the URL [by which your Facebook app is invoked] and if you app includes any other external resources (iframes, imgs, scripts, etc.) that sensitive data gets passed along to them in the HTTP Referer header.
From that article:
It's not clear if developers of many of the apps transmitting Facebook ID numbers even knew that their apps were doing so. The apps were using a common Web standard, known as a "referer," which passes on the address of the last page viewed when a user clicks on a link. On Facebook and other social-networking sites, referers can expose a user's identity.
From this article:
Sadly, all those parameters [identifying the Facebook user etc] go in the URL [by which your Facebook app is invoked] and if you app includes any other external resources (iframes, imgs, scripts, etc.) that sensitive data gets passed along to them in the HTTP Referer header.