I’m using the server side authentication flow to handle logging into my C# .NET website. Once the user logs in I establish a formsauthenticationtoken object to track that subsequent requests by the user are authenticated.
FB has the following policy:
Your website must offer an explicit "Log Out" option that also logs the user out of Facebook.
(This is #6 at the following location – https://developers.facebook.com/policy/)
I have provided the Log Out button and it logs the user out of FB and my application when they click it.
But, what if the user logs out of FB in another browser tab? Do I need to log the user out of my application as well? In my case, I don’t technically need to log the user out of my application because my user token was established upon logging in and I don’t have any reliance on FB after logging in.
Thanks,
No, you don’t have to log your user out of the other tab. However, if you’re paranoid about the security of your website it might be a good idea. One thing you could do i set an inactivity timer that logs the user out automatically if she doesn’t use the page for 5 minutes.