I'm using the Manual Login Flow from facebook to login users to my site. This means, redirecting them to accept the app, and the getting their info. (my app is also physical, ==> one browser for many people)
I got it working as I wanted, however, as they are only redirected to login, they are kept logged-in at browser-level, meaning that if another user comes after them and tries to login, they will only be shown the other person's profile, or be redirected as if they logged in.
Thus, I need a log-out method at browser-level, but I can't find any links, or api to logout a user from the browser.
Does anyone know how?
Thanks!
Related
API page is here: https://developers.facebook.com/docs/javascript/reference/v2.6
As far as I know,
If users have already authorized a web app(a website), then invoking FB.login() and FB.logout() in the web app is essentially logging user in or out of Facebook and return the web app with some data(of course you need access token to do this). Assume you have two pages opened, one is your web app, the other is facebook.com. Both logged out initially. Now if you log in with your Facebook account in the web app page, and then if you refresh the other page, you will find that both are logged in. It's similar for the case of logging out.
Well, correct me if my understanding is wrong. I totally understand there are reasons for the logic.
Is there a way to log out users from by web app but keep them logged in with the Facebook and without revoking permission?
I've tried with Google+ OAuth. It seems that using Google+ API is able to log out users from the web app and keep them logged in with Google+.
Well it is how it should be. You want your app to be an interface for the "Facebook app" login, why is that? Consider the scenarios from the user's point of view-
User is logged-in and browsing facebook. He found the useful application of yours and login to your app(providing required permissions). Before leaving your app, he logouts from the app. He then gets back to the Facebook and continue browsing there. All good!
User in NOT logged-in to the facebook. He logs into your app, browse your app then logs out of it. Then, when he open the facebook.com why will he expect that he should be looged-in to facebook automatically? I think he wont think that and he'll login to facebook and continue.
The point is simple here-
if user logs into facebook, he'll be logged-in until and unless he logs out from facebook.
if user is not logged into facebook but logs into your app, he will be logged-in to the facebook until he logs out from your app.
OK, so my application works fine and dandy, but I recently discovered a problem when a user is logged in "as a page". When the user is logged in as a page and goes directly to the app base url... i.e. apps.facebook.com/... it correctly identifies that the user object is incorrect and sends the user to:
https://www.facebook.com/login/roadblock.php?target_url=...
This makes the user login as the actual FB user, and it works well.
But it does not do this on the app's page tab. It just redirects to:
https://s-static.ak.facebook.com/platform/page_proxy.php?v=4
Is there a command or function in the PHP SDK that can check if the user is using as a page, and redirect them to the referred page?
There is currently no way to check if user logged in as page due to fact that Facebook doesn't provide this information and prompting to switch back to usage of regular Facebook account on any interaction with applications.
I'm trying to write application for user login to website via Facebook. When user is logging in, he's redirected to http://www.facebook.com/dialog/oauth/?client_id=APP_ID&redirect_uri=REDIRECT_URL&state=STATE, then sees confirmation dialog to use permissions and all goes well. But then FB somehow remembers this application and never asks for permissions confirmation again when user opens this url. Is there any way to always show this dialog? I could do it in Twitter, but couldn't found the answer for Facebook.
If you really want this for some reason, uninstall the app from the user's account with a HTTP DELETE request to /USER_ID/permissions using your app access token.
The next time they come back they'll need to re-authorise the app.
Otherwise, no, there's no way that I'm aware of apart from the reauthentication flow to force the auth dialog to appear, but bear in mind that the reauthentication flow may prompt the user to re-enter their Facebook password even if they're already logged into Facebook, so it adds extra friction to the process
Instead of showing the Facebook OAuth dialog, you could also show the user a page on your application that has some information about the Facebook account that is going to be used (picture/name etc), to log into it. That way, if they like they can choose to log out and re-authenticate or continue knowing they have the right account.
I've created an app that works fine, however if the user has not authorized my app yet, they have to do the following (assuming they are in facebook AND logged in) -
go to my app
click login/authorize
popup with facebook permissions opens
accept in the popup
However I noticed with Zynga games like Mafia Wars 1/2, Farmville etc, when you go to the app, if it hasn't been authorized, it takes you straight to the permissions which is in a PAGE and not a popup, thereby eliminating one step. Also, the permissions dialog is full width, there is not app sidebar.
Does anyone know how I can duplicate this flow? It would be much easier to have users authorize within a facebook page rather than through a popup. How can I get permissions inside the page?
thanks in advance
Once user visit a Page tab with your application you can check if he is connected with your application by comparing Page ID with User ID in signed_requests, for unauthorized users ID's will be same. In that case you can start authentication flow by redirecting user's browser to "login url".
If you want it to be full page just do the redirect with JavaScript like this:
window.top.location = 'https://www.facebook.com/dialog/oauth?
client_id=YOUR_APP_ID&redirect_uri=YOUR_URL&scope=COMA_SEPARATED_PERMISSIONS'
If you using PHP you can construct Login URL by calling Facebook->getLoginUrl method.
Read the docs on Facebook authentication
well i have used the facebook api couple of times. But last day i just came across a site which was really new to me. Heres the scenario
If a user is logged in at facebook and comes to my site, he will
automatically be logged in without asking him and also if user logs
out of my site he gets logged out of facebook. But the site i saw
yesterday, they had handled it perfectly, user dose not logs in their
site automatically and even if user logs out from their site, he does
not gets logged out of facebook.
So any help? what is this technique called? or any relevant help?
Best Regards
most site handled the login/authenication by using the login status of the user at facebook ends.
to do what u wants, simply add an additional layer of authentication / login status checking at your own site.
The site level login status is to be retained only for the current session. In other words, once the user went away from the site, the site level login status is gone. With this, when the user returns, you know that he needs to login again.
when the user logged out from your site, you only log him out of your site and do nothing about facebook login
Using the Facebook SDK it will likely tell you the user is logged out when not logged into Facebook, which in theory is the correct behaviour of the whole system, as Facebook want user's to always be connected to Facebook, I quote facebook:
As long as the user is signed into Facebook, they are automatically signed into your site as well.
So if they aren't connected to Facebook, you aren't connected to other sites. In a way it's a deterrant and increases Facebooks market.
But anyhow, it's likely the site you are describing are implementing their own authentican system rather than using Facebook's own SDK, or if they are using the SDK they are using it in moderation and understand about cookies/the above.
The flow to allow the user to be logged into Facebook but out of your site is as so:
When a user logs out of their site, it will unset session data for the site's own application, and also unset Facebook cookies, etc. That way the user is still logged into Facebook but out of your site.
When they try to log in again, Facebook will detect no cookies are available and hence will re-authenticate and pass you onto the url as passed during the authentication process. Your site will then login the user to the site's own application, setting any session variables, etc.
you need to check how you are handling the FB logins and sessions at your end..
my guess is you check the is login at your site and there are some access_tokens which are as per your app id in the cookies of your browser which are helping you to log in ..
and when logging out from your site you are explicitly logging out the user from FB as well
( thats what you are describing atleast )
you seem to be explicitly calling logout or clearing the cookies for fb app id ..