Facebook cookie retained until manual referesh

I'm building a PHP site that uses Facebook OAuth as the login mechanism. The problem is that when the user logs out and is directed back to my site, the site is still effectively logged (at least in appearance) in until the user manually refreshes the page.

I suspect the reason for this is because the Facebook cookies are removed only once the return page has finished rendering. I accept I'm not fully versed in the way sessions work.

User logs out -> Redirect to Facebook -> Redirect back to site (logout.php) -> Clear local session -> Redirect to home page (index.php) -> Page renders (still logged in) -> Cookies removed -> Manual refresh (index.php) -> Page renders (no longer logged in).

I had a similar issue with an ASP.NET MVC site a little while ago. My fix then was to parse the page with JavaScript after the page had loaded and once the cookies had finally been removed.

I am working on the assumption that I'm doing something wrong. I simply want index.php to recognise that Facebook is logged out without having to refresh.

I use header() to redirect from logout.php to index.php.

header("Location: index.php");

EDIT: I have tried appending the current time to the redirect url in order to side step caching problems. This has not helped.

EDIT: Watching cookie activity in FireCookie backs up my suspision that the Auth cookie is removed after the page is rendered. This is obviously not conclusive as FireCookie doesn't show me what's happening server side.

JS Workaround: My current workaro开发者_JAVA技巧und is to run the following snippet on page load, where $fbUid is the Facebook User ID. It's not ideal though, because it relies on JavaScript.

        FB.getLoginStatus(function(response) {
            if (<?php echo $fbUid ? "true" : "false" ?> && response.session == null)
                window.location.reload();
        });

Rich

---

Probably a cacheing issue. Add some randomly generated value to the query string in the redirect, so it'll appear as a "new" page to the browser, something like:

header('Location: index.php?cachebuster=' . microtime(true));

That should force the browser to fetch a fresh copy, which would then not have the "logged in" content anymore.

---

Cracked it with help from Delete facebook session cookie from my application on users logout and the SDK source.

Adding this code snippet to the logout page ensures that the authentication is properly removed.

$facebook = new Facebook(array(
  'appId'  => FB_APP_ID,
  'secret' => FB_SECRET,
  'cookie' => true,
));

$fbCookieName = 'fbs_' . $facebook->getAppId();

$domain = $facebook->getBaseDomain();
if ($domain) {
  $domain = '.' . $domain;
}

setcookie($fbCookieName, '', time() - 3600, '/', $domain);
$facebook->setSession();

The code empties the cookie and expires it at the same time. The session is then explicitly removed.

Rich

---

hi i have same this issue but i resolve this issue buy using this FB.Event.subscribe('auth.login', function(response) {

window.location.reload(); }); FB.Event.subscribe('auth.logout', function(response) { window.location.reload(); });

please add this script where you have to write your login code. and enjoy