title: Facebook Canvas app: Force SSL
body: <p>after searching the web for a while, I am still not able to find the correct solution to my problem; How to make sure the browser is redirected to the https app url. Since the canvas app is an iframe, we don't have access to change the window.top.location to the https equivalent.</p>
  
  <p>If the visitor comes to</p>
  
  <p><a href="http://apps.facebook.com/app_name/" rel="nofollow">http://apps.facebook.com/app_name/</a></p>
  
  <p>I want him redirected to</p>
  
  <p><a href="https://apps.facebook.com/app_name/" rel="nofollow">https://apps.facebook.com/app_name/</a></p>
  
  <p>Totally unable to fix it with javascript in the app loaded in the canvas since top.location is impossible to tamper with due to cross-domain origin rules. It could have been fixed easily with a redirect rule implemented by Facebook, and I am surprised it's not a checkbox in the Facebook app setup to enforce SSL. We do not want our game to be accessible over http.</p>
  
  <p>I have tested to set both Canvas URL and Secure Canvas URL to point to the https url, but that gives this error (cross-domain trouble): Unsafe JavaScript attempt to access frame with URL <a href="http://apps.facebook.com/app_name/" rel="nofollow">http://apps.facebook.com/app_name/</a> from frame with URL <a href="https://s-static.ak.facebook.com/" rel="nofollow">https://s-static.ak.facebook.com/</a></p>
  
  <p>Please advice.</p>