How logout works in Facebook SDK Android

Question

I'm a bit confused about how facebook.logout(context) works.

Because even after calling log out, I am able to get access to information that requires an auth_token. So how is that even possible? I came across this topic, which let me a bit confused: https://stackoverflow.com/a/6597688/487940

After reading that answer, this is my question: So if the user grants access to [my] application, he will always be authenticated if he is logged into the [official] facebook application? Even if I try to call facebook.logout(context) in [my] application, he will be logged in and my application will be able to make calls to Facebook API?'

Sorry, about I'm not able to understand this behavior.

UPDATE: After reading Torid's reponse, I am confused about facebook.logout() function. What is the purpose of this function if it does not log the user out? Because, I don't see the purpose of calling this purpose anymore. It doesn't log the user out.

Answer 1

There are two independent things going on here: 1) whether your user has authenticated your app (with permissions) to Facebook and 2) whether your user is logged in to Facebook.

Authentication is required the first time your user uses your app and lasts until the user explicitly de-authenticates (e.g. through the Facebook web Account Settings -> Apps -> App Settings).

Log in may be required each time your user starts your app. But if you use the default SDK authorize(), that tries to do a Single Sign On (SSO), where if the Facebook app is logged in, your app is automatically logged in and uses the existing access token.

If you are using SSO, when you do a logout, that has no effect, as a real logout would have to log out the Facebook app - which the user might not like!

You can get around this behavior by doing an authorize of the form

authorize(this, PERMISSIONS, FORCE_DIALOG_AUTH, new LoginDialogListener());

which avoids SSO and forces a dialog login. Of course, that then forces your user to login each time you start your app - unless you save the login details / access token under the covers (which is what the SDK does - check the source).