CODEWITHSUNDEEP
facebooksessionlogout
sarenagay
sarenagay

Reputation: 65

How to logout from facebook or destroy an active session using php?

I have an application which asks for a registration through facebook but before a user can proceed to the registration, the system should first determine if there is an active session. If a user is logged in to facebook, it should then automatically logout for a fresh start.

But here is where I'm stuck. The SDKs only let the user log out from facebook if he is connected to your app. It uses the app's access token. But what if he is still not registered to your app? Their log out means to log out from your app, and not really from facebook.

My requirement :

1. How can i log out from facebook.

2. How can i clear the browser cookies?

Not on a specific app but the whole facebook session.

Upvotes: 0

Views: 11504

Answers (3)

Ahmed Albusaidi
Ahmed Albusaidi

Reputation: 161

1) logging out from facebook by using 

facebook=>getLogoutUrl();

2) clearing the session by using :

$facebook->destroySession();

example:

<a href="logout.php">Log Out</a>

logout.php page codes as follow:

<?php
require 'facebook.php';
$facebook->destroySession();
header( "location:index.php" );
?>

Upvotes: 0

C3roe
C3roe

Reputation: 96151

[from comments] But to use the getLogoutUrl() function, the user has to be connected to your app. What I need is to logout from the whole facebook and not just from the app

If the user is connected to your app, then the URL provided by the getLogoutUrl method does that – log the user out of your app (web-app) and out of facebook.com.

If the user is not connected to your app however, you don’t have an active user access token – and then logging out of Facebook is not possible. The obvious reason being that if it was, every website that I visit could log me out of Facebook in a “drive-by” manner – without me actively wanting that, so people would get annoyed quite quickly.

If a user is logged in to facebook, it should then automatically logout for a fresh start.

If this is a security consideration, then you are in fact looking for re-authentication, which can be done using the auth_type parameter, quote from docs:

In apps where security is very important, you may want to double-check someone's identity - perhaps before they make a purchase within the app, or use it to access some sensitive personal data.

To prevent situations where a user could leave a device logged in or man-in-the-middle hijacking of the user session, re-authentication forces a person to re-enter their Facebook password before they can continue to use your app.

Be aware to use the server-side Auth flow though – because in the client-side flow, using the JS SDK, there is a bug that allows the user to bypass re-entering his password by simply closing the popup, which is still open: https://developers.facebook.com/bugs/248632218597467 (Has been assigned Priority: High, but received still nothing more than a “we will follow up” response yet.)

Upvotes: 1

phwd
phwd

Reputation: 19995

Use the logout.php url.

https://developers.facebook.com/docs/reference/php/facebook-getLogoutUrl/

Basically, 

 http://facebook.com/logout.php?next=YOUR_NEXT_URL_FOR_LOGOUT&access_token=USER_TOKEN

Upvotes: 0

Related Questions