Facebook PHP SDK Caching User

Question

I'm currently implementing a site that uses FB Connect as well as our own system to handle logins. The way it is currently setup, a user who has previously been to our site and approved our permissions is auto-logged in when they visit the site again. Also, if the user hits the logout button when they're logged into their account using FB it will log them out of FB.

Right now if a user is logged in and hits the logged out button it logs them out of FB fine. The site automatically goes to create them a new session and a check gets called to see if the user is still logged into FB using the PHP SDK getUser() function. It seems that even though the user logged out the SDK is caching the user ID and saying they're logged in anyways ... from the SDK. You can see the call to the cache below. Is there anyway to over-ride this w/o modifying the FB SDK or am I approaching the problem wrong?

if ($this->user !== null) {
  // we've already determined this and cached the value.
  return $this->user;
}

return $this->user = $this->getUserFromAvailableData();

Answer 1

The problem: what if the user logged out through facebook and not with the link you provided which calls the session killer.

You will still have the session cached even though the user is gone.

Answer 2

It might have something to do with your application flow. The FB PHP SDK has given me a hard time too.

This might help though:

Log the user out by redirecting them to the logoutUrl, this will then redirect back to your site. At this point you need to call $facebook->destroySession();

Take a look at what that code does (as show in line 1092 of base_facebook.php ):

/**
 * Destroy the current session
 */
 public function destroySession() {
     $this->setAccessToken(null);
     $this->user = 0;
     $this->clearAllPersistentData();
 }

After this, clear your sessions normally and the user should be completely logged out and not cached.

In my code, when I generate the loginUrl and logoutUrl, I do the following:

$fb_data = array(
     'loginUrl'  => $facebook->getLoginUrl(array('scope' => 'email,user_birthday')),
     'logoutUrl' => $facebook->getLogoutUrl(array('next' => base_url('index.php/authenticate/kill_session'))),
);

It's in the authenticate/kill_session method that I call $facebook->destroySession();

Answer 3

You can use a combination of JS AND PHP to solve the issue of user logging out from the FACEBOOK site.

On your page load, load a JS getloginstatus(), and anytime one does not match the other (ie. facebook JS loginstatus != Your site login status), force a refresh (via JS) of your page that handles the mismatch.

It may look buggy (page refreshes automatically), but its OK for me.