Question

I am working on an application that is basically going to operate in a Kiosk, the point is to allow users while they are at a business to be able to login to facebook and after logging in it posts a message saying they are there, afterwords they are given a coupon.

The problem has arisen that after they have logged in and then logged out, the next person logs in with their account ends up posting as the previous user, this continues adnauseum.

After getting their coupon the script automatically logs them out after 15 seconds and returns the application to the home screen for the next user. When they login, which they are able to do it returns them to the page asking for permission to post, but it is pulling all of the previous users information. This is the code being called in the page after being sent to logging in on facebook.

<?php
//include the Facebook PHP SDK
include_once 'couponGenerator/facebook.php';

//start the session if necessary
if( session_id() ) {

} else {
session_start();
}

//instantiate the Facebook library with the APP ID and APP SECRET
 $facebook = new Facebook(array(
'appId' => '00000000000',
'secret' => '000000000000000000000',
'cookie' => true,
'status' => true,
'oath' => true
));

$access_token = $facebook->getAccessToken();
$_SESSION['active'][$access_token];
//get the news feed of the active page using the page's access token
$page_feed = $facebook->api(
'/me/feed',
'GET',
array(
    'access_token' => $_SESSION['active']['access_token']
)
);
$fbuser = $facebook->api('/me');
//var_dump($page_feed); exit;
?>

I have attempted on the homepage of of deleting facebook cookies and sessions and this has not solved anything, I am just trying to figure out what I am doing wrong and any advice would be very welcome.

$facebook->destroySession();
$facebook->_killFacebookCookies();

 public function _killFacebookCookies() 
{ 
    // get your api key 
    $apiKey = $this->getAppId();
    // get name of the cookie 
    $cookie = $this->getSignedRequestCookieName();

    $cookies = array('user', 'session_key', 'expires', 'ss'); 
    foreach ($cookies as $name)  
    { 
        setcookie($apiKey . '_' . $name, false, time() - 3600); 
        unset($_COOKIE[$apiKey . '_' . $name]); 
    } 

    setcookie($apiKey, false, time() - 3600); 
    unset($_COOKIE[$apiKey]);
    $this->clearAllPersistentData();
    }

Here is the updated connection class
`

<?php
//include the Facebook PHP SDK
include_once 'facebook.php';

//instantiate the Facebook library with the APP ID and APP SECRET
$facebook = new Facebook(array(
    'appId' => '122628977190080',
    'secret' => '123123123123123123123123',
    'cookie' => true
));
    $access_token = $facebook->getAccessToken();
    unset ($_SESSION['active'][$access_token]); 
    session_unregister ($_SESSION['active'][$access_token]); 
//Get the FB UID of the currently logged in user
$user = $facebook->getUser();

//if the user has already allowed the application, you'll be able to get his/her FB UID
if($user) {
    //start the session if needed
    if( session_id() ) {

    } else {
        session_start();
    }

    //do stuff when already logged in

    //get the user's access token
    $access_token = $facebook->getAccessToken();

    //check permissions list
    $permissions_list = $facebook->api(
        '/me/permissions',
        'GET',
        array(
            'access_token' => $access_token
        )
    );

    //check if the permissions we need have been allowed by the user
    //if not then redirect them again to facebook's permissions page
    $permissions_needed = array('publish_stream', 'email');
    foreach($permissions_needed as $perm) {
        if( !isset($permissions_list['data'][0][$perm]) || $permissions_list['data'][0][$perm] != 1 ) {
            $login_url_params = array(
                'scope' => 'publish_stream,email',
                'fbconnect' =>  1,
                'display'   =>  "page",
                'next' => 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']
            );
            $login_url = $facebook->getLoginUrl($login_url_params);
            header("Location: {$login_url}");
            exit();
        }
    }

    //if the user has allowed all the permissions we need,
    //get the information about the pages that he or she managers
    $accounts = $facebook->api(
        '/me/accounts',
        'GET',
        array(
            'access_token' => $access_token
        )
    );

    //save the information inside the session
    $_SESSION['access_token'] = $access_token;
    $_SESSION['accounts'] = $accounts['data'];
    //save the first page as the default active page
    $_SESSION['active'] = $accounts['data'][0];

    //redirect to manage.php
    header('Location: ../facebook_result.php');
} else {
    //if not, let's redirect to the ALLOW page so we can get access
    //Create a login URL using the Facebook library's getLoginUrl() method
    $login_url_params = array(
        'scope' => 'read_stream,email',
        'fbconnect' =>  1,
        'display'   =>  "page",
        'next' => 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']
    );
    $login_url = $facebook->getLoginUrl($login_url_params);

    //redirect to the login URL on facebook
    header("Location: {$login_url}");
    exit();
}

?>`

After calling the logoff script, I am run this piece of code on the homepage to see if everything is set.

<?php
        try {
    $uid = $facebook->getUser();
    $fbme = $facebook->api('/me');
    echo "$uid";
} catch (FacebookApiException $e) { 
    print_r($e);
}
        ?>

it gives me this result

FacebookApiException Object ( [result:protected] => 
Array ( [error] => Array ( [message] => 
An active access token must be used to query information about the current user. 
[type] => OAuthException [code] => 2500 ) ) 
[message:protected] => An active access token must be 
used to query information about the current user. 
[string:private] => [code:protected] => 0 [file:protected] =>
/home/m3dev/public_html/couponsite/couponGenerator/base_facebook.php 

[line:protected] => 1046 [trace:private] => Array ( [0] => Array ( [file] =>   /home/m3dev/public_html/couponsite/couponGenerator/base_facebook.php [line] => 751 [function] => throwAPIException [class] => BaseFacebook [type] => -> [args] => Array ( [0] => Array ( [error] => Array ( [message] => An active access token must be used to query information about the current user. [type] => OAuthException [code] => 2500 ) ) ) ) [1] => Array ( [function] => _graph [class] => BaseFacebook [type] => -> [args] => Array ( [0] => /me ) ) [2] => Array ( [file] => /home/m3dev/public_html/couponsite/couponGenerator/base_facebook.php [line] => 560 [function] => call_user_func_array [args] => Array ( [0] => Array ( [0] => Facebook Object ( [appId:protected] => 162628977190080 [apiSecret:protected] => **SECRET KEY REMOVED ** [user:protected] => 0 [signedRequest:protected] => Array ( [algorithm] => HMAC-SHA256 [code] => 961628b1ca0354544541d58e.1-34319949|p3D3pSNoawlC1wBllhiN7zoEpJY [issued_at] => 1331218933 [user_id] => 34319949 ) [state:protected] => [accessToken:protected] => 162628977190080|**SECRET KEY REMOVED** [fileUploadSupport:protected] => ) [1] => _graph ) [1] => Array ( [0] => /me ) ) ) [3] => Array ( [file] => /home/m3dev/public_html/couponsite/index.php [line] => 71 [function] => api [class] => BaseFacebook [type] => -> [args] => Array ( [0] => /me ) ) ) )

Answer 1

You may be destroying a Facebook session but you don’t seem to be destroying your own session.

Clear out

$_SESSION['active'][$access_token];