i am using iframe to render my app from my server. the problem is once i click on a link in my app, i am being redirected to my server. i mean, i remain in tha canvas page for a
There is a known reason for this but it takes some investigation to find. IIRC, what happens is that when someone changes pages inside your iframe, you are making another require_login call. the FB client tries to use available data to authenticate - post / get / cookies - but if it fails it will redirect to an fb login. If the user is already logged in and authorized your app, this will instantly (invisibly) redirect back to your app, but there is a bug on facebook's end (I think) that causes it to redirect to your callback url instead of your canvas url, hence popping out of frame.
Solution: pass the fb_ get params in your query string along to every page. Basically take everything starting with "fb_" in the url and tack it on to all of your links. This gives the api client something else to validate with.