Facebook PHP-SDK doesn't unset SESSION if user revokes application permissions - facebook

Question

EDIT***
I think I didn't explain enough/correctly, here are the steps when I have the problem with the session:
1.- User logins with jssdk and accepts my app.
2.- Now I use the PHP-SDK to getUser(); and restrict or show some pages.
3.- User DOES NOT log out, but revokes the permissions directly from the profile settings.
4.- User returns to my application (without closing the page/browser of course) and the PHP-SDK still returns getUser() as a valid
connected user!
5.- How my application is supposed to know that the user revoked the permissions if the PHP-SDK says the getUser() is a valid ID?
My users login to my application with the JS-SDK and the following code:
FB.login(function(response) {
// handle the response
}, {scope: 'email,user_likes'});
-- and this is the asynchronous script
<div id="fb-root"></div>
<script>
window.fbAsyncInit = function() {
FB.init({
appId : '****************', // App ID
channelUrl : 'localhost', // Channel File
status : true, // check login status
cookie : true, // enable cookies to allow the server to access the session
xfbml : true, // parse XFBML
oauth:true
});
// Additional initialization code here
};
// Load the SDK Asynchronously
(function(d){
var js, id = 'facebook-jssdk', ref = d.getElementsByTagName('script')[0];
if (d.getElementById(id)) {return;}
js = d.createElement('script'); js.id = id; js.async = true;
js.src = "//connect.facebook.net/en_US/all.js";
ref.parentNode.insertBefore(js, ref);
}(document));
</script>`
However, when the users remove the application from their privacy settings and try to access my application again, this code still outputs the user ID $user = $facebook->getUser();
I checked the facebook.php from the PHP-SDK and there's a method that is supposed to unset the SESSION but doesn't unset anything.
protected function clearPersistentData($key) {
if (!in_array($key, self::$kSupportedKeys)) {
self::errorLog('Unsupported key passed to clearPersistentData.');
return;
}
$session_var_name = $this->constructSessionVariableName($key);
unset($_SESSION[$session_var_name]);
}
Is this a bug? or Facebook always reads the session even if the user revoked the permissions of the application?
I think the behavior of $facebook->getUser(); should output 0 when the user is not connected to the application, but of course this is not what happens.

Answer 1

Session and permission via Facebook are 2 different things.
A session is application and user specific to your code. You need to control this session.
If someone revokes permissions for your app, then all it does it remove permission in Facebook. Your app isn't notified unless you have setup the correct settings in your Facebook app. And even still you need to clear the session.
So while the session will hold the information it previously obtained, if you try to connect to perform something on Facebook with the permissions you previously had you will get an error.