facebook iframe app; php sdk getUser() returns valid id on page one but not for any other page

Question

I have a facebook iframe app which correctly logs in and authorizes the app, but getUser() only works on the first page. As soon as a user clicks a link to a new page within the iframe, getUser() returns 0.

What's strange is that this same code works for another app... I do all the clicking I want and getUser() returns a valid ID.

The app that doesn't work: https://apps.facebook.com/celestial_glory/

The one that does (same codebase): https://apps.facebook.com/uprisingstlouis/

Here's the code I am using:

require_once ('fb/facebook.php');

// snip... set $app_id, $secret, and $canvas_page

// first, try normal facebook getUser().  If that works, awesome.

$facebook = new Facebook(array(
  'appId'  => $app_id,
  'secret' => $secret,
));

$signed_request = $_REQUEST['signed_request'];

// Get User ID
$user = $facebook->getUser();
if ($user != '0') return 'fb=' . $user; // works once

// getUser() didn't work.  Try oAuth.  Maybe user needs to log in or
// authorize the game?

$auth_url = 'http://www.facebook.com/dialog/oauth?client_id='
  . $app_id . '&redirect_uri=' . urlencode($canvas_page);

list($encoded_sig, $payload) = explode('.', $signed_request, 2);

$data = json_decode(base64_decode(strtr($payload, '-_', '+/')), true);

if (empty($data["user_id"])) {
  echo '<a target="_top" href="' . $auth_url . '">Login to Facebook</a>';
  exit;
// normally we would auto-redirect, but with a uid of 0, this just auto-redirects
//    echo("<script> top.location.href='" . $auth_url . "'</script>");
} else {
  return 'fb=' . $data['user_id'];
}

any ideas? I have triple-checked app ids and secrets and canvas pages. If those were wrong, I expect no page, not even the first, would work.

Answer 1

Change Facebook PHP-SDK initialization to:

$facebook = new Facebook(array(
  'appId'  => $app_id,
  'secret' => $secret,
  'cookie' => true // this!
));

getUser works on the first page because it can get the user from signed_request (POST'ed by Facebook to your canvas page URL). Thus you need some way to track your user once he starts navigation deeper within your application. You could pass signed_request somehow all by yourself or simply enable built-in PHP-SDK cookie support as suggested above.