0

I am using FB.getLoginStatus() and FB.Login() to log the user into my website using facebook. I first check for the status on page load using FB.getLoginStatus() and save the state in a hidden variable. When the user clicks on my facebook login button, I first check the value in the hidden variable and call FB.Login() only if FB.getLoginStatus() is not connected. If FB.getLoginStatus() returns 'Connected', then I just log the user into my website without FB.Login().

My scenario with issue *user logs into my accont using facebook *user logs out of my website *my website is open in the logged out state *in another tab, the current facebook user logs out of facebook and a new user logs into facebook *user comes back to my website and clicks on facebook login button without refreshing the page *the old facebook user (not the one currently logged into facebook) is logged into my account

How can I identify the most current user in facebook when user clicks the facebook login button?

<body>
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
<div id="fb-root">
</div>
<script src="http://connect.facebook.net/en_US/all.js"></script>
<script>
// initialize the library with your Facebook API key    

var AppID = '<%=AppID%>';

window.fbAsyncInit = function() {
FB.init({
appId: AppID,
status: true,
cookie: true,
xfbml: true,
channelUrl: 'http://<%=Request.ServerVariables("HTTP_HOST")%>/channel.html'
});

FB.Event.subscribe('auth.login', function(response) {
//alert('logged in');
});

FB.Event.subscribe('auth.logout', function(response) {
//alert('logged out');
});

FB.getLoginStatus(function(response) {
if (response.status === "connected") {
var uid = response.authResponse.userID;
document.getElementById('hdnFBConnected').value = uid;
}
else if (response.status === "not_authorized") {
//alert("Not authorized");
document.getElementById('hdnFBConnected').value = '';
}
else {
//alert("user not logged in to facebook");
document.getElementById('hdnFBConnected').value = '';
}
});
}; 
</script>

<a href="#" onclick="WindowOpen()"><img src="<%=global_language & "/images/FacebookSmall.gif"%>" /></a>

<script type="text/javascript" language="javascript">
function WindowOpen() {

if (document.getElementById('hdnFBConnected').value != '') //user is connected
{
FB.api('/me', { fields: 'first_name, last_name, locale, email' }, function(result) {

var uid = document.getElementById('hdnFBConnected').value;    

//log the user into my site
})
}
else { //user is not connected, so calling FB.Login()
FB.login(function(response) {
if (response.authResponse) {
var access_token = response.authResponse.accessToken;

FB.api('/me', { fields: 'first_name, last_name, locale, email' }, function(result) {

var uid = response.authResponse.userID;    

var globalLang = '<%=global_language%>';
//log the user into my site                            })
}
else {
//alert('User cancelled login or did not fully authorize.');
}
}, { scope: 'email' }
); 
}

}
</script> 

</body>
Pia Palackathadom
  • 95
  • 1
  • 4
  • 12
  • I also tried to call FB.getLoginStatus() inside WindowOpen() instead of on load. I then called FB.Login() when FB.getLoginStatus() != connected. But then the auth popoup is being blocked by the popup blocker. Please help. – Pia Palackathadom Jul 31 '12 at 20:03
  • Have you tried setting the second parameter to true, as described here https://developers.facebook.com/docs/reference/javascript/FB.getLoginStatus/ under the heading “Roundtrips to Facebook's servers” …? – CBroe Aug 01 '12 at 09:14
  • Yes i did, but that did not help. It does not give me the most current user. Thanks for the suggestion. – Pia Palackathadom Aug 02 '12 at 12:59

1 Answers1

0

What you're describing is normal behavior. The JS SDK is sending the old user's signed_request object which allows the new user to access her account. Since this concerns you, include a logout button on your app's page and let the user know that it's important she clicks that button when she's done using your app. The logout button should call FB.logout like so:

FB.logout(function(response) {
  // user is now logged out
});

For extra security, you can create an activity timer that prompts the user to click a button after X minutes of inactivity. If the user doesn't click within, say 1 minute, she is logged out automatically. This is how most banking sites deal with session security.

Gil Birman
  • 35,242
  • 14
  • 75
  • 119
  • Thanks for the suggestion. I solved my issue by calling FB.getLoginStatus() repeatedly using a timer. Its now giving the most current facebook user. – Pia Palackathadom Aug 02 '12 at 13:02