Index: fb_canvas.module
===================================================================
--- fb_canvas.module	(revision 3691)
+++ fb_canvas.module	(working copy)
@@ -282,11 +282,12 @@
   // Url rewrites still used for iframe canvas pages.
   $patterns[] = "|{$base_url}/" . FB_SETTINGS_CB . "/{$fb_app->apikey}/|";
   // Here we hard-wire apps.facebook.com.  Is there an API to get that?
-  $replacements[] = "http://apps.facebook.com/{$fb_app->canvas}/";
+  // base_root is from Drupal's conf_init().
+  $replacements[] = fb_protocol() . "://apps.facebook.com/{$fb_app->canvas}/";

   // Fully qualified paths.
   $patterns[] = "|" . url('', array('absolute' => TRUE)) . "|";
-  $replacements[] = "http://apps.facebook.com/{$fb_app->canvas}/";
+  $replacements[] = fb_protocol() . "://apps.facebook.com/{$fb_app->canvas}/";


   // Facebook will prepend "appNNN_" all our ids
@@ -343,7 +344,7 @@
       $options['external'] = TRUE;
       $options[FB_SETTINGS_CB] = FALSE; // prevent fb_url_rewrite.inc from altering.
       $options['absolute'] = TRUE;
-      $options['base_url'] = 'http://apps.facebook.com/' . $fb_app->canvas;
+      $options['base_url'] = fb_protocol() . "://apps.facebook.com/{$fb_app->canvas}";
     }
     if (fb_canvas_is_iframe()) {
       if (!$options['absolute']) {
Index: fb.module
===================================================================
--- fb.module	(revision 3691)
+++ fb.module	(working copy)
@@ -290,9 +290,8 @@
       $fb_lang = variable_get('fb_language_' . $user_language->language, 'en_US');
     }

-    $default = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https' : 'http';
-    $default .= "://connect.facebook.net/$fb_lang/all.js";
-    fb_js_settings('js_sdk_url', variable_get(FB_VAR_JS_SDK, $default));
+    $js_sdk = fb_protocol() . "://connect.facebook.net/$fb_lang/all.js";
+    fb_js_settings('js_sdk_url', variable_get(FB_VAR_JS_SDK, $js_sdk));
   }

   // Add our module's javascript.
@@ -1465,18 +1464,6 @@
 }

 /**
- * Convenience wrapper around drupal_access_denied().  Call on pages where the
- * access is denied because the user is not logged into facebook.
- */
-function fb_access_denied() {
-  if (!fb_facebook_user()) {
-    drupal_set_message(t('You must <a href="#" onclick="FB.login(function(response) {}, {perms:Drupal.settings.fb.perms}); return false;">log into facebook to view this page</a>.'));
-  }
-  drupal_access_denied();
-  exit();
-}
-
-/**
  * Menu callback for custom channel.
  *
  * @see http://developers.facebook.com/docs/reference/javascript/FB.init
@@ -1493,4 +1480,27 @@
   $output .= "<script src=\"$url\"></script>\n";
   print $output;
   exit();
-}
\ No newline at end of file
+}
+
+//// Miscellaneous helpers and convenience functions.
+
+/**
+ * Protocol (http or https) of the current request.
+ */
+function fb_protocol() {
+  return (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https' : 'http';
+}
+
+
+/**
+ * Convenience wrapper around drupal_access_denied().  Call on pages where the
+ * access is denied because the user is not logged into facebook.
+ */
+function fb_access_denied() {
+  if (!fb_facebook_user()) {
+    drupal_set_message(t('You must <a href="#" onclick="FB.login(function(response) {}, {perms:Drupal.settings.fb.perms}); return false;">log into facebook to view this page</a>.'));
+  }
+  drupal_access_denied();
+  exit();
+}
+