title: facebook iframe app; php sdk getUser() returns valid id on page one but not for any other page
body: <p>I have a facebook iframe app which correctly logs in and authorizes the app, but getUser() only works on the first page.  As soon as a user clicks a link to a new page within the iframe, getUser() returns 0.</p>
  
  <p>What's strange is that this same code works for another app... I do all the clicking I want and getUser() returns a valid ID.</p>
  
  <p>The app that doesn't work: <a href="https://apps.facebook.com/celestial_glory/" rel="nofollow">https://apps.facebook.com/celestial_glory/</a></p>
  
  <p>The one that does (same codebase): <a href="https://apps.facebook.com/uprisingstlouis/" rel="nofollow">https://apps.facebook.com/uprisingstlouis/</a></p>
  
  <p>Here's the code I am using:</p>
  
  <pre><code>require_once ('fb/facebook.php');
  
  // snip... set $app_id, $secret, and $canvas_page
  
  // first, try normal facebook getUser().  If that works, awesome.
  
  $facebook = new Facebook(array(
    'appId'  =&gt; $app_id,
    'secret' =&gt; $secret,
  ));
  
  $signed_request = $_REQUEST['signed_request'];
  
  // Get User ID
  $user = $facebook-&gt;getUser();
  if ($user != '0') return 'fb=' . $user; // works once
  
  // getUser() didn't work.  Try oAuth.  Maybe user needs to log in or
  // authorize the game?
  
  $auth_url = 'http://www.facebook.com/dialog/oauth?client_id='
    . $app_id . '&amp;redirect_uri=' . urlencode($canvas_page);
  
  list($encoded_sig, $payload) = explode('.', $signed_request, 2);
  
  $data = json_decode(base64_decode(strtr($payload, '-_', '+/')), true);
  
  if (empty($data["user_id"])) {
    echo '&lt;a target="_top" href="' . $auth_url . '"&gt;Login to Facebook&lt;/a&gt;';
    exit;
  // normally we would auto-redirect, but with a uid of 0, this just auto-redirects
  //    echo("&lt;script&gt; top.location.href='" . $auth_url . "'&lt;/script&gt;");
  } else {
    return 'fb=' . $data['user_id'];
  }
  </code></pre>
  
  <p>any ideas?  I have triple-checked app ids and secrets and canvas pages.  If those were wrong, I expect no page, not even the first, would work.</p>