title: Prevent facebook canvas app from being accessed directly/outside of facebook
body: <p>I'm developing a canvas application for facebook and I want to prevent users from accessing the application directly from the canvas URL (as much as possible, I realize this might not be possible 100% of the time) and force users to access the app from apps.facebook.com/foo.</p>
  
  <p>I'm developing the app with php, and my first thought was to check the $_POST array for 'signed_request,' which is the value passed from facebook to the canvas app, and send a redirect if this value was not present but it appears this value is only passed once and when users click different links in my application the 'signed_request' parameter is not passed again.</p>
  
  <p>Can I reasonably trust 'HTTP_REFERER' to verify users are accessing the application from <a href="http://apps.facebook.com/foo" rel="nofollow">http://apps.facebook.com/foo</a> and redirect users when HTTP_REFERER does not equal that value?</p>
  
  <p>EDIT:
  I've actually just noticed that on the original request for the app at apps.facebook.com/foo the HTTP_REQUEST header is equal to 'apps.facebook.com/foo' but when the user clicks a link in the app HTTP_REQUEST becomes equal to the canvas url.</p>