https - When facebook application use Secure Canvas? -
i have facebook application, , host have selfsigned certificate. thats not problem, because browsers used canvas url (with http), , worked fine. other browsers requires secure canvas url (with https), , throw exception if secure canvas url empty, or if host has incorrect certificate.
how browser/facebook decides when use canvas url, , when secure canvas url? can make them use canvas url only, without https?
if i'm correct applications have setting "october 2011" or (i'll try verify you). maybe if disable 1 can use http. idea behind implementation put every new applications on https.
now can understand development purposes want try without https. not every browser acts same way self-signed certificates (chrome <-> ff).
in business environment suggest have valid certificate.
edit : possible duplicate of question http://facebook.stackoverflow.com/questions/7308348/facebook-canvas-apps-https-and-http
edit 2 : apps on facebook authentication , security migration (https)
all canvas , page tab apps must convert process signed_request (fb_sig removed) , obtain ssl certificate use in "secure canvas url" , "secure page tab url" (unless in sandbox mode). must provide ssl certificate in dev app settings avoid having app disabled.
so ... in sandbox mode?