Question

so I’m trying to program the Facebook logout feature for my site

The thing is using the facebook logout button will instead logout the user from the Facebook website not from my website

so my current logic is when the logout button is clicked, it instead calls my app’s logout feature and session gets cleared etc

but then I also have logic somewhere else in which if $facebook->getUser() returns the uid properly, fetch the user info from the db and set him as logged in

is there a way to prevent $facebook->getUser() from returning the proper user id?

IE when user clicks on the logout, he shouldn’t be logged out of the actual facebook website, but also $facebook->getUser() should also not return a proper id so that he won’t be automatically relogged in again

Answer 1

The thing to remember when working with the Facebook SDK is that when you authenticate, you are essentially logging in to Facebook & your website separately – you need to cater for this logic.

Once signed in to Facebook, an authentication cookie is created (not a session). You might be using sessions for your site authentication, but Facebook is using a cookie.

You need to call $facebook->destroySession(); if you do not want the UID returned on subsequent calls.

Take a look at my CodeIgniter code, the *index.php/authenticate/kill_session* method calls the above destroySession(); method as well as clears my app session – this completely logs me out of both Facebook and my app:

<?php
class Facebook_model extends CI_Model 
{ 
public function __construct()
{
    parent::__construct();

    $this->config->load('facebook');

    $config = array(
       'appId'      => $this->config->item('facebook_api_key'),
       'secret'     => $this->config->item('facebook_secret_key'),
       'fileUpload' => false,
    );

    $this->load->library('Facebook', $config);
}

public function connect()
{
    $user = $this->facebook->getUser();

    $profile = null;

    if($user)
    {
        try {
          $profile = $this->facebook->api('/me');
        } catch (FacebookApiException $e) {
            error_log($e);
            $user = null;
        }
    }

    $fb_data = array(
       'me'        => $profile,
       'gender'    => $profile['gender'],
       'uid'       => $user,
       'loginUrl'  => $this->facebook->getLoginUrl(array('scope' => 'email,user_birthday')),
       'logoutUrl' => $this->facebook->getLogoutUrl(array('next' => base_url('index.php/authenticate/kill_session'))),
    );

    return $fb_data;
}

public function disconnect()
{
    $this->facebook->destroySession();
}

 } // EOC