Question

How can a database-less application be aware of whether the current user of application has already given permission to this application, or whether they are a first time user?

I simply redirect to a Facebook URL, and then if they are a new user Facebook shows the permission dialog box to the user, and if not then Facebook simply redirects to my URL.

Answer 1

You must check a signed_request in php:

$signed_request = $_REQUEST["signed_request"];
    if ( empty($signed_request) ) {

        $perms = true;

    } else {

        list($encoded_sig, $payload) = explode('.', $signed_request, 2);

        $data = json_decode(base64_decode(strtr($payload, '-_', '+/')), true);
        if ( empty($data["user_id"]) ) {
            $perms = false;
        } else {
            $perms = true;
        }

    }