restrict acces to a application facebbok only to my friends

how to restrict access to only a facebook applicatio开发者_JAVA技巧n to my friends. in this case by "facebook connect " without having to use the "sandbox"

I know it must allow only the id of his friends but technically how it goes?

You can have your list of friends by querying https://graph.facebook.com/me/friends, using your user access token (not the app token). Facebook will return a JSON array of your friends. You can read more info here: http://developers.facebook.com/docs/reference/api/

You can then iterate through the JSON array and store a list in your server, e.g. in java:

try {
    JSONObject response = new JSONObject(txtResponse);
    ArrayList<String> myFriends = new ArrayList<String>();
    for (int i=0; i<response.data.length; i++) {
        myfriends.add (response.data[i].id);
    }
    // store the list somewhere
} catch (JSONException e) {
    // something went wrong. 
}

On your client side, you can get the user id in javascript. I'm writing the ajax call in jquery just to be brief. You can use plain javascript.

if(FB.getSession() != null) {
    var session = FB.getSession();
    if (session.uid===undefined)
       session = session.session;
    $.post("login", {id:session.uid}, function (response) {
        // you do here whatever you want based on the server decision to allow access or not.
    });
}

Of course, there will be a servlet responding that ajax post that will compare the id with the ones in myFriends list.

PS1: I wrote this on top of my head, so there may be typos/errors, but you get the idea.

PS2: Instead of the graph api, you can use also fql. More info here: http://developers.facebook.com/docs/reference/fql/