Cookie Not Being Cleared On Logout

[d6veteran]

Reproduce:

1. Login to Facebook as User A (who has authorized GB).
2. Logout of Facebook.
3. Login to Facebook as User B (who has authorized GB).
4. Go to GB App page on Facebook.
5. User B will see User A's profile including Brag box. User B should see User B's profile when going to the application. The default landing page for the application should be the profile of the logged in user.

[d6veteran]

What's odd is that if I logout from the GB app page, I don't also get logged out of Facebook. Is that how it should work . . . ??

I need to go to a couple sites using FB connect . . . I guess that's probably right:

1. If you log into Facebook, you are also logged into 3rd party site.
2. If you log out of 3rd party site, you do NOT log out of Facebook.
3. If you log out of Facebook, you are also logged out of 3rd party site.

It seems like there should not be an option to log out of the 3rd party site without also logging out of Facebook. Right? Like you can log out of Facebook, but not log out of GB on it's own. In other words the concept of logging in an out is really only Facebook, and GB simply logs you in and out under the covers, based on inspecting the FB Cookie (to see if you are logged into FB or not).

Right?

[d6veteran]

I'm not sure if the latest version was a fix for this but I still see this behavior.

[sampyxis]

So, if you log out of FB - is there a way to force the user to log out of GB if it's not open? Probably not.

We'll need to put a check in on the open of the GB page to make sure we not only get the cookie from the user - but first check that it's the currently logged in user for the FB session.

[sampyxis]

Ok
It works if when the user first goes to the gb site - we force them to go to this url /auth/login - that works with the fb session and makes sure we have the correct user.

So, in the code we can either force them there (maybe sloppy since the url isn't clean) - or duplicate the code to do the login handler

[sampyxis]

This works now - and actually - we've switched it so we're just following what the user is doing with FB - if they are logged in to FB and they have added GreenBean - then they'll automatically be logged in here.