This was a very frustrating problem for us in our app Jobs (http://apps.facebook.com/getthejob).

The problem was that in IE, if a parent frame has a different domain than the child page, the session data (stored in the Session object) is not preserved. This is a so-called “security feature.”

Anyway, if you have this problem, the answer is here: http://support.microsoft.com/kb/323752

Simply put, in your ASP.NET page codebehind, add the following code: [code]

   protected override void OnPreRender(EventArgs e)  {      Response.AppendHeader(”P3P”, “CP=\”CAO PSA OUR\”");      base.OnPreRender(e);  }

[/code]

This will add the right headers to every page.

Also cross-posted to the facebook developers wiki