How to log out user using facebook SDK?

Question

I am using a facebook log in for my web site using facebook php sdk.

What I noticed is the logout link doesn't do anything. After I logout, the user can still navigate the site. Here is my code in facebook.php:

<?php
    require 'src/facebook.php';
    $facebook = new Facebook(array(
           'appId'  => '*************',
           'secret' => '******************************',
    ));
    $user = $facebook->getUser();
    $loginUrl = $facebook->getLoginUrl();
    echo "<a href='$loginUrl'>login</a>";

    $logoutUrl = $facebook->getLogoutUrl();
    echo $loginUrl; 
    if($user){
        session_start() ; 
        $_SESSION['user_info'] = $user; 
        $_SESSION['user_pro']= $facebook->api('/me');
        print_r($_SESSION);
    }
    else{
        echo 'not logged in '; 
    }

    echo "<a href='example.com/logout.php'>log out </a>"
?>

This code works fine on log in. The log out link should destroy the session. Here is the header of the page:

<?php 
    print_r($_SESSION) ; 
    header('example.com') ; 
?>

The problem with my logout.php page is it doesn't detect the session at all. I don't know if this is a facebook api problem or my php problem.

How do you log the user out using the facebook SDK?

Users can logout from facebook... they can't logout from your site. — Kode Plus, Jul 14 '12 at 12:25

score 20 · Accepted Answer · edited Sep 19 '13 at 18:11

20

You can logout from your site as well as from facebook as follow by providing your site url to next parameter and destroying session

$token = $facebook->getAccessToken();
$url = 'https://www.facebook.com/logout.php?next=' . YOUR_SITE_URL .
  '&access_token='.$token;
session_destroy();
header('Location: '.$url);

You also have to log them out of your website AND you have to prevent your website from automatically remembering your user and re-logging them in immediately.

Disable the code that auto-logs in your user and try to logout again. Destroying the session will not prevent your site from creating a brand new valid session for the remembered user.

edited Sep 19 '13 at 18:11

Eric Leschinski

146,994
96
417
335

answered Jul 18 '12 at 08:18

Needhi Agrawal

1,326
8
14

i tried `session_destroy()` and it never works , i do what i wrote in my answer , hopefully on the long run it doesn't do any breaks – Mina Gabriel Jul 18 '12 at 12:27
This works for me. What happened in my case was the URL that `getLogoutUrl()` was producing had `access_token=0`. So I followed the example above manually adding the access token using `$facebook->getAccessToken();`. But I'm just wondering why the `getLogoutUrl()` function couldn't add it, and used zero instead. Any ideas? – Obay Mar 30 '13 at 19:42
This worked for me. It logs me out of Facebook and destroys the session for my app. Why isn't this documented anywhere? Is this still the "official" solution? – Michael Lynch Aug 16 '16 at 15:40

Eric Leschinski · Answer 2 · 2013-09-19T18:32:19.560

Here is the PHP logout code for my website that logs a user in and out with facebook. You don't have to destroy the session to logout the user, all you technically have to do is signal to your own website that this particular session may not be used to let the user in.

logout.php:

<?php
    require_once("facebook-php-sdk-6c82b3f/src/facebook.php");
    $config = array();
    $config['appId'] = '2911111111146';
    $config['secret'] = 'a6eaaaaaaaaaaaaaaaaaaaaaaaaaad1a';
    $config['fileUpload'] = false;
    $facebook = new Facebook($config);
    $logouturl = $facebook->getLogoutUrl();
    $_SESSION['user_facebook_email'] = "";
    $_SESSION['ask_user_to_login'] = true;
    header("Location: showquestions.php");
?>

index.php:

<?php
    require_once("facebook-php-sdk-6c82b3f/src/facebook.php");

    $config = array();
    $config['appId'] = '2911111111146';
    $config['secret'] = 'a6eaaaaaaaaaaaaaaaaaaaaaaaaaad1a';
    $config['fileUpload'] = false;

    $facebook = new Facebook($config);
    $userId = $facebook->getUser();
    if ($_SESSION['ask_user_to_login'] == true || $userId == 0){
      $loginUrl = $facebook->getLoginUrl();
      $_SESSION['ask_user_to_login'] = false;
      echo "<button type='button' onClick=\"window.location='$loginUrl'\">" .
           "<img src='picture.gif' alt='Login with facebook'/>" .
           "</button>";
      exit;
    }
    else
    {
      $userInfo = $facebook->api('/' + $userId);
      session_cache_expire (150000);  //set the cache expire to 15000 minutes
      $_SESSION['user_facebook_email'] = $userInfo['email'];
      $_SESSION['facebook'] = $facebook;      
      header("Location: showquestions.php");
    }
    $userInfo = $facebook->api('/' + $userId);
    echo "Welcome" . $userInfo['email'];
?>

login.php:

<?php
    session_start();        
    if (isset($_SESSION['user_facebook_email']) !== true || 
        $_SESSION['user_facebook_email'] == "")
    {
        header("Location: index.php");
        exit;
    }
?>

Then in every php file you want to prevent access without a logged-in user, put this at the top:

<?php
    require("log2.php");
?>

With this code, the user is logged in automatically, and if they invoke the logout code, the site will not let them in until they login again.

Rudi Visser · Answer 3 · 2012-07-14T12:31:37.357

0

You need to call session_start() on all pages where sessions will be used.

To log somebody out of the session (ie. clear it) you can use session_destroy().

Finally, header('example.com'); won't actually do anything, are you intending to perform a redirection? If so, you should use `header('Location: http://example.com/');

EDIT: Sorry I hadn't read this properly, what is the second code snippet? Is that your logout.php page?

As far as I'm aware with the Facebook API, when you're calling getLogoutUrl(), that is where you should send your users when they click the link, and not your own logout.php.

edited Jul 14 '12 at 12:31

answered Jul 14 '12 at 12:24

Rudi Visser

21,350
5
71
97

@MinaGabriel Damn idiots, I +1'd your question for balance since you still haven't resolved it. – Rudi Visser Jul 18 '12 at 12:49

score 0 · Answer 4 · answered Jul 14 '12 at 12:29

0

Logging out users from facebook can be difficult. This works for me

// Get an instance of the Facebook class
$facebook = $this->facebook_instance_factory();
// Destroy the session so that no Facebook data is held
$facebook->destroySession();
$logout = $facebook->getLogoutUrl();
$facebook->setAccessToken('');
// Redirect the user to the logout url, facebook will redirect him to our page
wp_redirect( $logout );

answered Jul 14 '12 at 12:29

Nicola Peluchetti

76,206
31
145
192

wp_redirect doesn't work outside of Wordpress. Use `header("Location: $logout"); exit;` – 1owk3y Feb 17 '15 at 22:36

Mina Gabriel · Answer 5 · 2014-01-08T21:27:43.977

0

ANSWER

  $_SESSION['fb_(your_APP_ID)_access_token'] = '' ;

when log in a session is initialized , it seems that if we set any of these session variable to null it breaks the log in function , and ask the user to log in again

edited Jan 08 '14 at 21:27

answered Jul 15 '12 at 01:27

Mina Gabriel

23,150
26
96
124

How to log out user using facebook SDK?

5 Answers5

Linked