Checking for if (window!=window.top) only indicates whether the application is open in the iframe or not. However, this does not mean that it is a FaceBook iframe. When the application opens in the FaceBook iframe (for example, http://apps.facebook.com/demoapp/ ), FaceBook sends the signed_request parameter. If this parameter is valid, you can safely assume that the request comes from a FaceBook iframe. If you do not redirect to the application page using:
<script type="text/javascript"> top.location.href = "http://apps.facebook.com/demoapp/"; </script>
source share