Question

The question is the same as title. I’m using the latest php-sdk (v3.1.1) to operate server-side authentication flow.

I have 2 tabs in Chrome, one is my Facebook page and the other is php test page. These 2 problems happen many times:

• $facebook->getUser() still returns 0 even when I logged in.
• $facebook->getUser() still returns an ID even when I logged out.

I have to do a work-around of this: try initiating a graph API request with provided access_token, and check if $response->error->type == "OAuthException" to ensure there’s an active session or not.

Is there any way to use $facebook->getUser() “stably”? I’ve searched a lot through SO but not found best answer for php-sdk 3.1.1 yet.

Highly appreciate any helps. Thanks.

Answer 1

1. Login.
   As per documentation example of FB SDK, getUser() returns userId even when you’re logged out, but have cookies associated with FB account.
   To detect is user logged in you should use

   $user = $facebook->getUser();
   //Check Access token
   if ($user) {
        try {
           $user_profile = $facebook->api('/me');
        } catch (FacebookApiException $e) {
           $user = null;
        }
   } 
   if ($user) { 
       //logged-in
   } else {
       //not logged-in
   }
   

   To login in your app make user logs in in your app, not on neighbouring tab, by following this url (make sure that you’re passing the scope based on intended actions performed by your app):

   $loginUrl = $facebook->getLoginUrl(
       'scope' => ...
   );
   

2. Logout. Seems that your PHP server is storing some values of access tokens per session, so even when you’re logged out in your browser, your server still have these tokens valid. Actually, I don’t know, is it bug or feature, but they’re not destroyed by Facebook after user logout.

   To destroy these tokens I’m using these:

   $facebook->destroySession();
   

   I’m calling it every time when user logs-out by $facebook->getLogoutUrl();