Should Facebook canvas apps behave same if opened from original non-canvas site url?

Question

This is a first time I am trying to make a facebook application/game, and I have couple of questions.

Let's say canvas url is http://mysite/first_app/ and facebook app url is https://apps.facebook.com/first_app

I wonder if visited both url-s should a functionality be the same? I mean does facebook give you more tools and freedom if navigated from https://apps.facebook.com/first_app ? Or should both url-s look and do the same thing? Is it possible?

Answer 1

Yes, you have more tools available in the canvas ("apps.facebook.com.."), as it will send you the user-id without any user consent. Has the user previously used your app, you will also be able to get their accesstoken and fetch more info about them.

It requires some backend code to decode the signed request parameter, which provides you this stuff.

This example is how php handles signed request: https://developers.facebook.com/docs/facebook-login/using-login-with-games/

If you're using C#, download the Facebook C# (available through NuGet, the package from Outercurve Foundation) and use this example: How do I parse a signed request in Facebook C# SDK?

I try to handle the user in Facebook context whenever possible. It adds trust and more tools. Although since the Facebook phone/tablet app (App Store/Google Play) doesn't support Facebook apps at all, I often optimize the app for mobile web use also. I read somewhere that over 50% of daily Facebook visists are done using the phone app, so it might be something to think into your app while developing.

UPDATE: I can see I have misunderstood part of signed request, as commented by Shadowfax and CBroe. In my app, I use the user id from signed request but of course only when the user has already logged on to the app beforehand. My apologies.

Answer 2

I wonder if visited both urls should a functionality be the same

Of course yes. The difference is just that one is deployed at the facebook's app center and the other at your domain.