How to know if my page is running in a facebook iframe or not

Question

I\'m currently developing a site which runs standalone and as a facebook app on an iframe I was wondering what whold be \"best practice\" for checking if my page is ran in a

Answer 1

I ran into this same question this morning - I want desktop users to access my app through facebook but I want mobile users to be able to access the app directly via URL. Like Floyd Wilburn said, accessing the different versions of the app through different URLs is a good option, but instead of having two copies of the app (hard to maintain) I used mod_rewrite to rewrite the /facebook directory to the app root:

# rewrite both /facebook and / to same place so you
# can tell if your request came from facebook or from direct URL access :)
RewriteEngine on
RewriteBase /
RewriteCond %{REQUEST_URI} /facebook*
RewriteRule (.*) /index.php [L]

Be sure to set your Facebook page tab URL to land in the /facebook subdirectory. Now, you can browser sniff to see if they're a mobile or desktop user, and you can test the requested URL to see if they're accessing the app through Facebook or directly :)

Let me add that there is NO foolproof way to determine either the client type or access point - both can be spoofed by someone who knows what they're doing - so take this into consideration when designing your app's security and authentication mechanisms.