I have been looking for a solution to this from last few weeks now.
As per Facebook docs, https://developers.facebook.com/docs/facebook-login/permissions#reference-user_friends
In order for a person to show up in one person's friend list, both people must have decided to share their list of friends with your app and not disabled that permission during login. Also both friends must have been asked for user_friends during the login process.
...And notification API needs friends' ID:
https://developers.facebook.com/docs/games/services/appnotifications#implementation
As per this information, one cannot send notifications to all friends (or to be precise, cannot send notification to a user who has not authorized your app for the same).
...but I get notifications from apps I haven't authorized (I checked, revoked permissions; still get notifications). What am I missing here?
Example of one such app: Candy Crush (Game).
