This was a very frustrating problem for us in our app Jobs (http://apps.facebook.com/getthejob).
The problem was that in IE, if a parent frame has a different domain than the child page, the session data (stored in the Session object) is not preserved. This is a so-called “security feature.”
Anyway, if you have this problem, the answer is here: http://support.microsoft.com/kb/323752
Simply put, in your ASP.NET page codebehind, add the following code:
</p> <pre> protected override void OnPreRender(EventArgs e)<br /> {<br /> Response.AppendHeader("P3P", "CP=\"CAO PSA OUR\"");<br /> base.OnPreRender(e);<br /> }<br /></pre> <p>
This will add the right headers to every page.
Also cross-posted to the facebook developers wiki
