Question

I’m using the below code for my app. If I deny the permission, I am still able to access the app, but it should not take me to app right?

Where am I going wrong?

 //Facebook Authentication part 
   $user       = $facebook->getUser();

   $loginUrl   = $facebook->getLoginUrl(
    array(
        'scope' => 'publish_stream,read_stream',

    )
 );
  $me = null; 
 // Session based API call.
  if ($session) {
try {
  $uid = $facebook->getUser();
 $me = $facebook->api('/me');
  } catch (FacebookApiException $e) {
   error_log($e);
 }
 }


  if (!$user) {
echo "<script type='text/javascript'>top.location.href = '$loginUrl';</script>";
exit;
  }

Answer 1

I am not sure this will give you the answer you are looking for. But I just wonder if you are aware of the expected authentication flow of a Facebook application.

When the “Don’t Allow” is selected then the Facebook dialog box will redirect to:

http://YOUR_URL?error_reason=user_denied&
 error=access_denied&error_description=The+user+denied+your+request.

Where YOUR_URL is the redirect_uri paramater that was specified in the oauth dialog URL.

Check out Facebook Authentication Docs