title: Facebook oauth redirect does not work in iframe
body: <p>Recently I noticed that my applications on Facebook stopped to work properly.</p>
  
  <p>When someone opens app who did not authorize in yet I display simple content with link,
  When link is clicked, in application I issue redirect (in Spring I return "redirect:...url..") to URL:</p>
  
  <p><a href="https://www.facebook.com/dialog/oauth?scope=email&amp;client_id=317651918315301&amp;redirect_uri=https%3A%2F%2Fapps.facebook.com%2Facnestop&amp;scope=email&amp;response_type=token" rel="nofollow">https://www.facebook.com/dialog/oauth?scope=email&amp;client_id=317651918315301&amp;redirect_uri=https%3A%2F%2Fapps.facebook.com%2Facnestop&amp;scope=email&amp;response_type=token</a></p>
  
  <p>it sends 302 with given location to iFrame.</p>
  
  <p>Then blank iFrame is displayed, and following headers from FB are returned:</p>
  
  <pre><code>Cache-Control   private, no-cache, no-store, must-revalidate
  Connection  keep-alive
  Content-Encoding    gzip
  Content-Type    text/html; charset=utf-8
  Date    Fri, 25 May 2012 10:37:11 GMT
  Expires Sat, 01 Jan 2000 00:00:00 GMT
  P3P CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
  Pragma  no-cache
  Set-Cookie  _e_1vFX_0=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly locale=pl_PL; expires=Fri, 01-Jun-2012 10:37:11 GMT; path=/; domain=.facebook.com wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly
  Transfer-Encoding   chunked
  X-Content-Type-Options  nosniff
  X-FB-Debug  VYI+cCm/Vfpx3US82n06uFuw5gF6UQDg+8GUSpGUL9A=
  X-Frame-Options DENY
  X-XSS-Protection    0
  x-content-security-policy...    allow *;script-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:*;options inline-script eval-script;report-uri https://www.facebook.com/csp.php
  </code></pre>
  
  <p>And just blank iFrame is displayed.</p>
  
  <p>When URL which I redirect to is pasted to browser directly - it displays Facebook prompt to authorise app.</p>
  
  <p>Any ideas why behavior is different when iFrame is redirected from pasting and opening same link in browser?</p>
  
  <p>I noticed this today, previously app was working fine.</p>
  
  <p>This is my sample app:
  <a href="https://apps.facebook.com/acnestop/" rel="nofollow">https://apps.facebook.com/acnestop/</a></p>