$facebook->getUser(); still returns 0

Question

I have a development site and a production site running on a shared server. I use fb_loginUrl with the following code, which works.

I'm moving the production site to a new domain, also on the shared server. I copied the entire code including the PHP SDK. I've used the new domain's appID and secret. On the new domain, fb_loginUrl shows the login dialog if needed, correctly calls FB, and receives a GET call back. But user is always 0, even if there is a user logged in on the machine. There is not a CSRF error. If I keep going round the endless loop, it does throw a CSRF error the second time, and every second time after that.

The problem should be somewhere in the settings for the new app, but they're the same as the old ones with names and addresses updated, and I've tried the changes I can think of including a trailing slash on the return url. I'm starting to wonder if FB applies some different invisible defaults to newly registered apps (not completely paranoid - default settings on the web dashboard are different, such as the value of "deprecate offline_access" - but I've brought everything into line with my old setup).

Why might this run differently in different domains?

require_once '../facebook/facebook.php';
if(!isset($facebook)) $facebook = new Facebook(array(
  'appId'  => $facebook_appid,
  'secret' => $fb_secret,
  'scope' => 'email'
));

$fb_user = $facebook->getUser();
echo ' USER: ' . $fb_user;

if ($fb_user) {
  try {
    $fb_user_profile = $facebook->api('/me');
  } catch (FacebookApiException $e) {
  }
}

Answer 1

I think getUser just pulls data from cookie, so try adding

'cookie' => true, to new Facebook call, eg

 new Facebook(array(
   'appId'  => $facebook_appid,
   'secret' => $fb_secret,
   'scope' => 'email',
   'cookie' => true, 

If you test app outside of facebook chrome by going directly to iframe, make sure url matches to what you put in canvas url in app settings, eg if there is a www in front or not.