Why my Facebook app asks asks if I'd like to access their friend list?

Question

I'm developing a Facebook application which only requires access to their basic user information and e-mail address. In the scope I specify the e-mail and my URL like so:

https://www.facebook.com/dialog/oauth?client_id=123&redirect_uri=http://www.example.com/&state=d8c7767e8aa5470a44ec50c2737e2d8a&display=popup&scope=email

However, when I open that URL, Facebook asks:

Example App would like to access your public profile, friend list and email address.

I have not specified the friend list permission, nor do I want it.

Answer 1

The friend list is part of basic permissions.

You can read the list of friends via /userid/friends and this list is different than the extended permission read_friendlists, which are the list you created and added your friends to those (e.g. University, StackOverflow, my company...).

That's why Facebook automatically ask for it even if you do not specify those extra permissions in your Facebook App settings or in your query (scope query string).

You can find more information here and here.