3

Per the SDK, I am using the logout.php with redirect:

https://www.facebook.com/logout.php?confirm=1&next={SOME URL}&access_token={ACCESSTOKEN}

It is logging me out fine, but it's also logging the user out of facebook. Isn't there a way of logging out of my OAuth session without logging out of facebook?

2 Answers 2

5

Yes, I ran into this same issue myself. Dont do logout.php or JS SDK's FB.logout(). Rather call the Graph API with an HTTP Delete command to me/permissions. That will kill the access token, remove the app from the user's app listing and maintain their browser's cookie for facebook. You can call it either server side or client side. Here's the client side Javascript SDK way:

FB.api("me/permissions","delete", function(response){/*do something if you want*/})
4
  • But I don't want it to remove my app from their facebook, just log them out of my web-app. Commented Jan 11, 2012 at 23:56
  • Then don't call any facebook method, just call Session.End() (php.net/manual/en/function.session-destroy.php)or remove your sites auth cookie.
    – DMCS
    Commented Jan 12, 2012 at 0:13
  • @DMCS I have the same issue. If I throw away the server side access token, and the user has multiple accounts, and he starts the oauth flow again with my app, will he be prompted? I'm worried facebook will immediately give me back my unexpired access token for the user that just logged out of my app, without a prompt to choose a different user.
    – Andy Nuss
    Commented Apr 30, 2012 at 2:12
  • If you do that delete command prior to prompting the user for any auth dialogs, it doesn't log them out of facebook, just removes your app from their list so they will have to reauth.
    – DMCS
    Commented Apr 30, 2012 at 17:20
1

This is one of the many annoying things about developing on the Facebook platform. The only way to log out via a browser session is to use their javascript logout function or the redirect like you tried but either will also log the user out of Facebook which is very annoying from a users perspective. The problem is you can't access the cookie they set for your app to delete it due to cross-domain restrictions so you are stuck with the limited options Facebook provides. If you are not prompting for offline_access, you could just forget the users access token and it will expire after an hour. Although the problem still exists that the cookie is still set for within that hour.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.