The Canvas sample uses Spring Social's typical OAuth 2 flow to obtain an access token. While this works, it's not the best approach for a canvas-based application. This sample should be updated to show how to use the signed_request parameter given to the application by Facebook.
In the course of updating this sample, there may be opportunity to improve Spring Social to support the Canvas model of application. If so, separate issues should be opened to address those items.