Question

Before I started implementing Facebook authentication, my logout controller looked like this:

# Kill the session
$this->session->sess_destroy();

# Redirect back to main page.
redirect('', 'location');

I tried modifying it to log the user out of Facebook as well, but no luck.

# Kill the session
$this->session->sess_destroy();

require 'application/sdk/facebook.php';

// Create our Application instance (replace this with your appId and secret).
$facebook = new Facebook(array(
  'appId'  => '625256',
  'secret' => '25256256',
  'cookie' => true,
));

$session = $facebook->getSession();

if ($session) {
    $location = (string) html_entity_decode($facebook->getLogoutUrl(array('next' => 'http://localhost:8888/taketocollege/')));
    header("Location: $location");
    exit();
}

# Redirect back to main page.
redirect('', 'location');

What am I doing wrong? I’m not looking to use the Javascript SDK for this since I want it all to be done in the controller.

Thanks!!

EDIT: To be a bit more clear, the problem is that the session isn’t being destroyed. My logout controller sends users to the home page, but the home page redirects Facebook users with a session to the login page. So the Facebook users end up on the login page. Normally the login page would automatically log them in, but, by then, their session is destroyed.

Answer 1

My code initially redirected users to the home page.

$session = $facebook->getSession();

$me = null;
// Session based API call.
if ($session) {
  try {
    $uid = $facebook->getUser();
    $me = $facebook->api('/me');
  } catch (FacebookApiException $e) {
    error_log($e);
  }
}

if($session && !$this->session->userdata('logged_in'))
    redirect('login');

That code was redirecting users to the login page since the session had been changed, not completely erased.

By changing the last two lines, I was able to fix this problem:

if($me && !$this->session->userdata('logged_in'))
    redirect('login');

Hope it helps someone!