Facebook API - Session still exists after user logout

Question

I am using Facebook php-sdk in my iframe facebook app to get user login status. Right after I sign out using facebook Account > Log out link, the session is not destroyed yet. I must wait a few minutes before old session expires, then my app will again get the correct login status.

I expect the facebook to kill itself and the session when user signs out. How do I manually kill the session?

Here is my code:

$initParams = array(
  'appId'  => $conf['app_id'], 
  'secret' => $conf['secret_api_key'],
  'cookie' => TRUE,
);

$fb = new Facebook($initParams);
$fb->getSession();  // will return a session object eventhough user signed out!

SOLVED:

calling $fb->api('/me') will destroy the session if user has previously logged out. I've changed my code as following:

if ($session)
{
    try
    {
        $fbuid = $fb->getUser();
        $me = $fb->api('/me');
    }
    catch(FacebookApiException $e){}
}

If the API call is unsuccessful, $session will be set to NULL. Very weird behavior, I don't explain everything that is going on here but it solved my problem of having residual session object not being updated via getSession() method.

Answer 1

I'm using $fb->getUser() and what I did was almost identical with yours.

if ($fb->getUser())
{
    try
    {
        $me = $fb->api('/me');
    }
    catch(FacebookApiException $e){
        **$fb->destroySession();**
    }
}

I found that using only API to check whether FB is logged out or not sometimes is inconsistent, but with destroySession(), the session will surely be destroyed.

Answer 2

if you are using the javascript FB.INIT calls on the login page, then set status to false from true.

details about the status attribute : http://developers.facebook.com/docs/reference/javascript/FB.init/

Answer 3

Try finding the formatData function somewhere at LoginWindow (AS3) and find this line:

vars.redirect_uri = FacebookURLDefaults.LOGIN_SUCCESS_URL

Change the value for http://www.facebook.com/ and logout from that html page when logged in.

This is a temporary solution to logout if you are developer, not the end user.