I’m using the facebook php sdk on two of my sites (here and here).
On both it has been reported that in a thin client environment (citrix), if a user logs onto one of these sites, then other users on different clients in the same environment are logged into my sites as that user.
I’m guessing the citrix server is storing the cookies etc and so identifying to facebook as the same user. Has anyone encountered this before, and is there a solution.
This seems a major security hole in the facebook php sdk.
The latest version of the facebook sdk fixes this when you don’t use cookies.