Facebook iFrame tab

Question

I have read that Facebook requires that iframe pages uses secure connections (SSL).

But I am now setting up my first app and there are two fields, one "Canvas URL" and another for "Secure Canvas URL".

Has the Facebook policy changed? Is it possible to use an iframe with an non-secure canvas url?

Answer 1

Secure canvas urls are not required in these scenarios:

• The app is in sandbox mode and you are a developer or someone who can view the app in sandbox mode.
• The app is public and the user of your application has not enabled secure browsing on their Facebook account.

If your app is live (not in sandbox mode) and you want ANYONE to use your app, the you will need to get an SSL certificate for your server and add the secure URL to your app's settings

Here is a blog post from Facebook about the change they made in October 2011 http://developers.facebook.com/blog/post/2011/09/09/platform-updates--operation-developer-love/

Answer 2

Sorry in advance for my bad english:

Fb policy has changed a lot in the last period. Actually you NEED absolutly 2 canvas urls:

• "standard" canvas (simply, link the host where the app/program is stored)
• secure canvas (you need to buy a facebook certificate for your host where app is stored)

Basically the app works if you have and also if you don't have a SSL certificate, but people who have setted a strong app privacy on their fb accounts, aren't able to see your app (browser displays an error message: "this website is not secure bla bla, ecc")

Answer 3

Yes, you need a SSL certificate, but you can get 1 free cert in startssl.com.