i am using iframe to render my app from my server. the problem is once i click on a link in my app, i am being redirected to my server. i mean, i remain in tha canvas page for a
try putting this code on top of your page:
ob_start();
This should solve the problem of 'headers already sent' error at least.
http://www.facebook.com/login.php?v=1.0&api_key="xxxxx"&next=http://someurl.com/user.php&canvas=1";
adding canvas=1 seems to do the trick. Keeps it within the canvas and doesn't open the callback url.
There is a known reason for this but it takes some investigation to find. IIRC, what happens is that when someone changes pages inside your iframe, you are making another require_login call. the FB client tries to use available data to authenticate - post / get / cookies - but if it fails it will redirect to an fb login. If the user is already logged in and authorized your app, this will instantly (invisibly) redirect back to your app, but there is a bug on facebook's end (I think) that causes it to redirect to your callback url instead of your canvas url, hence popping out of frame.
Solution: pass the fb_ get params in your query string along to every page. Basically take everything starting with "fb_" in the url and tack it on to all of your links. This gives the api client something else to validate with.
I had this problem awhile back. Two things to try:
<?php
tag (it should be first in the file)