Local user can't log out when offline_access permission is set

Weird. Do you have login toboggan or some other modules that screws with drupal's logout enabled?

What happens if you log out of facebook in anther tab, then refresh the drupal tab?

Hi, I believe an issue I just filed is actually a duplicate of this issue.

To answer Dave in #2, it doesn't matter if you log out of Facebook. You always remain logged in to the Drupal site, or perhaps, as eelke put it, "user is logged in again with every redirect/reload".

I'm going to try eelke's solution and see if it works for me and report back in a minute or two.

So I applied eekle's code to line 657 of fb.module but to no avail. I've flushed the cache. I've also unchecked the offline_access permission in my FB application but I'm not sure if that has any affect after permission has been granted. Users still cannot log out.

Can you reproduce this on http://www.drupalforfacebook.org? I can't.

Hi Dave, I can confirm that I can't reproduce this issue on drupalforfacebook.org as I've successfully logged in and out. Would you like to try the dev site I'm experiencing the issue with: http://dev.londonfuse.ca

Hi Dave, It seems to be something introduced in rc6. I was having the same issue when I had updated to rc7. I recalled login and logout working correctly before the update so I reverted back to rc6 (didn't help) and then rc5. Reverting back to rc5 seems to have made the problem go away. I haven't looked into the code yet to see what's changed so I can't really speculate on what's going on. Hope this helps.

I am having the same issue with rc7. It requires to click twice on the logout link, first to clear fb session and then for Drupal session.

I'm looking to - even though I'm not a good programmer - I can't find anything that is holding onto the fb session.

I'm having the same issue but I also have many modules installed so I didn't want to add my case to the problem... To by pass the never logout issue, after searching, tweeking code and doing whatever I could think about I finally found a working scenario to allow the user to logout, but it's not very nice, neither clean :

- I enable the login/logout button in the facebook block, so when people use drupal fb they will get the facebook logout button.
- Pressing the fb logout will only logout from Facebook and not my site, but "?_fb_js_fbu=0" is added to the url so I added to my module a couple of lines to detect this variable and force the logout from my site as well :

if($_GET['_fb_js_fbu'] == '0'){
global $user;
$tmp = NULL;
session_destroy();
user_module_invoke('logout', $tmp, $user);
$user = drupal_anonymous_user();
drupal_goto('');
}

This is not clean and I wish to change that behaviour as soon as possible but for now that's the only way I found for a user to log out from my site when he logs in using drupal fb.

I hope it help some of you ;)
Clem

Just want to add that I think the problem is located in the js files (On logout after the page has loaded, the argument '_fb_js_fbu=xxxxxxx' is added to the url and then a refresh occurs).

The trouble with javascript errors is that any one can cause the rest of the javascript on a page not to run at all. So an error in any module's javascript will make it look like all other modules fail.

Look for errors in firebug and/or chrome console. Those often catch the root cause.

That's the problem... I don't think there is any js error, their must be some kind of conditional code executed in a case that should not be... or another module changing a variable that influence fb behaviour.

I'm going to have a look again tonight ... Let's hope ...

@eelke I put it on top of my custom module ...

Do you see any errors in Drupal's log?

I'm having similar issues with rc7 update. In FF I cannot log out at all (from Facebook Connect or Drupal). If I open another tab and go to Facebook, I am clearly not logged in. But back on Drupal I am connected. No JS errors. Log shows "Session closed for [user]", but not a subsequent session opened message, yet somehow I'm still logged in. No errors in log.

Here is a breakdown of what I'm experiencing in different browsers:
FF Win & Mac - cannot log out from drupal or disconnect from Facebook at all
Safari & Chrome Win & Mac - can log out completely but requires two clicks, first disconnects from Facebook, second logs out of Drupal
IE8 - can log out completely without issue with a single click

I can concur with aether. I'm experiencing the exact same results.

Same here. Somewhat of a security risk if using a public computer however if you log out of app via facebook it does log out of fb account but not the website/app.

Subscribing.

Same here. My log is the same as eelke. This only started happening after I enabled the offline_access permission.

So far I've traced it back to the facebook object cookie.

For some reason the facebook session cookie isn't being destroyed on session_destroy() and the method for expiring the cookie, as in _fb_logout, isn't working either. If you use the ff developer toolbar to clear session cookies, that will actually log you out of facebook and allow you to log out of drupal. It seems like if you were to successfully delete the cookie on logout then that would solve the issue.

I'm not sure why the cookie is being so persistent, or if that's event the root issue. That's just as far as I've gotten so far.

Can anyone reproduce using RC8 or latest dev release?

I'm running the latest dev version and this is finally working properly in firefox, but I haven't tried it in Chrome or Safari, and I'm not even going to comment on IE(any version) because I don't optimize for that garbage browser.

Hi all,

I have setup a complete clean drupal 6.20 with dff (http://dff.buzzitag.com) :

- If I set my facebook app extended permissions to "publish wall", logout with the drupal link works fine
- If I add the extended permission "offline_access", logout with drupal link fails

Dave I am going to share the admin password with you (in private) so if you have time to check, go for it. I'm going to make some further tests but I encountered in the code a method called "fb_user_check_session", is it used to check current session on Facebook everytime we logout ? The api key being set to "offline_access", may be the check doesn't work properly ...

Weird, you mean with offline_access permission you click logout and you remain logged in? Any errors in firebug console or drupal log?

I'm seeing the same behavior regardless of if I have offline_access permission selected or not. I do see the following error in the Firebug console:

JSON.parse - Line 9 which is:

function (c, b, a) {
return FB.copy(typeof c == "string" ? FB.create(c) : c, b, a);
}

When this is run there are several undefined variables showing in firebug.

I confirm that in my case once offline_access is enabled the login doesn't work properly.

I'm trying to output errors using firebug but I am not yet confortable with it.. Some messages I'm getting on logout trying to do a step by step :

- api-read.facebook.com : server does not support RFC 5746, see CVE-2009-3555
- Jquery.js - Line 13 - test for equality (==) mistyped as assignment (=)?

- Jquery.js - Line 13 - anonymous function does not always return a value
- fb_connect.js - Line 30 - assignment to undeclared variable FB_Connect

- fb.js - Line 29 - assignment to undeclared variable FB_JS
- all.js - Line 17 - reference to undefined property window.onload

I hope it helps ;)

Any news on this issue ? Is there still people having the login problem with the latest release ?

I'm still having the problem.

I just notice this problem upon upgrading to 6.3.rc10 (local user refuse to logout).
When I installed back 6.3.rc8 the problem went away (both facebook dan local user logouts smoothly).

I think I have a clue. Facebook's platform tends to be crappy, but this is a real ball of turd...

background: Once upon a time, facebook apps had just an apikey and a secret. Later they added an id number, just to make things more complex. But engineers there like to pretend you don't need both the id and the apikey. They think this because they don't actually use their own platform. Other engineers, for the same reason, think the two are interchangeable. Trust me they are both needed, and not interchangable (after all they are not the same value).

Here's the gem of code in facebook's javascript API:

    FB._apiKey = options.appId || options.apiKey;

Now, until recently, Drupal for Facebook passed the apiKey to the javascript API. But to solve (?) #1063240: comments plugin requires an application id, I started passing both the app id and apikey. Only now do I discover how this is handled in the facebook JS.

Later, my code looks to FB._apiKey expecting an apikey, not an ID. And I think this has something to do with this problem. Attempting to confirm that now.

What a waste of time tracking this down.

I'm still not sure why I am seeing this problem on some sites but not others. Anyway I've been working on a site that does have the problem, and this patch is what I've come up with. So far seems to be working. I'd really like to know if this fixes the problem for users on this thread.

Having the same prob in drupal 7

Dave i don't know how to use a patch would you please attach the updated file or release a new version

Chickens slaughtered belstaff ladies jacket in the United States, claim Belstaff menswear officials in Brussels, are cheap belstaff not fit to grace cheap belstaff jackets European tables.

As it cheap juicy couture tracksuits happens, a razor juicy couture tracksuits cheap that is safe juicy couture handbag in Europe is juicy handbags unlikely to electrocute juicy couture handbags Americans. So,

Dave,
I applied the patch #35 against 6.3.dev. It refuses to logout at all while keep refreshing the page again and again.

Just noticed that myself. Updated patch should fix.

You may notice some extra refreshes when you first test the patch. Facebook cookies names are changing from "fbs_APIKEY" to "fbs_APPID".

@danadeek, Also, I am checking into dev release to get more testing. Should be there as soon as drupal.org re-packages...

BTW, anyone know where I could get a cheap belstaff jacket? I've been looking all over.

Dave,
I applied your patch at #42 and so far seems to work like a charm. Thanks!!

I manually applied #35 to drupal 7 and ended with the same result as #41. I'll revert back and try to apply the changes from #42.

Latest 6.3.dev 2011-3-20 fixed the problem for me. Thanks Dave

Dave, after seeing this thread you should be beatified :-) The 6.3.dev fixed two issues for me, the language prefix and the logout.

Thanks for your efforts!

glad this is fixed! In rc11.

Ported Dave's changes to a patch for 7.x

Hi Dave, I've still got the same problem as #41 after installing rc11.

+1 Same issue here with rc11

I followed the upgrade instructions and upgraded to the rc11 version and I can't log out with any browser besides IE 9. Also I did notice that a bar appears on the top of the page only in IE when I log in or log out using facebook.

Please clear all cookies and retest, just to be sure.

It's possible I fixed it in .dev but not rc11, because sometimes git makes me believe I updated something when I really didn't.

@Dave - Any chance on getting those D7 fixes committed?

I cleared the cookies and cache and still only had success in IE.

I just pushed all the changes that went into rc11 into 7.x-3.x branch.

Since the previous three comments indicate this is not fixed, I'm not sure whether it is. I'm not seeing it anymore.

I've tested using the patch I gave in #48 and I've had success with it I've used Chrome, Firefox, and IE and I'm pretty sure it's fixed...maybe I missed a browser...

I'm sure I've cleared all the cookies and cache and still doesn't work in both Safari and Firefox. Facebook is being logged out but not Drupal. It seems it re-login Drupal after Facebook logout and the url on the browser still showing "?_fb_user_fbu=xxxxxx" where xxxxxx is my facebook account id. Here is my test case:

1. Clear cookies and cache in my browser (Safari)
2. Delete "session_key" in "fb_user_app" table for the Facebook user
3. Login the site using Facebook user account
4. Try to logout the site

However, I've checked with the database "fb_user_app" table and found "session_key" is the same as the one before I delete it. I'm not sure if this "session_key" is being generated everytime when I login or is persistent anywhere. Anything I've missed?

One more information (I'm not sure if they are useful or not). As my module have implemented 3 hooks, i.e. hook_fb, hook_fb_user and hook_user, and I've printed out the hook name, op and global $user->uid after I pressing "logout". I noticed that after user "3" (a facebook connected user) logout, the global user become "0" (anonymous) and then user "3" come back and login again (see below). Hope this help. (sorry for long text)

hook_fb: current_app->3
hook_fb: get_app->3
hook_fb: init->3
hook_fb: app_authorized->3
hook_fb: post init->3
hook_user: load->3
hook_user: logout->3
hook_fb: exit->3
hook_fb: current_app->0
hook_fb: get_app->0
hook_fb: init->0
hook_fb: app_authorized->0
hook_fb: post init->0
hook_fb: fb_op_js->0
hook_user: load->0
hook_user: login->3
hook_fb_user: post_external_login->3
hook_fb: exit->3
hook_fb: current_app->3
hook_fb: get_app->3
hook_fb: init->3
hook_fb: app_authorized->3
hook_fb: post init->3
hook_user: load->3
hook_fb: fb_op_js->3
hook_fb: get_fbu->3
hook_fb: exit->3
hook_fb: current_app->3
hook_fb: get_app->3
hook_fb: init->3
hook_fb: app_authorized->3
hook_fb: post init->3
hook_user: load->3
hook_fb: fb_op_js->3
hook_fb: get_fbu->3
hook_fb: exit->3
hook_fb: current_app->0
hook_fb: get_app->0
hook_fb: init->0
hook_fb: app_authorized->0
hook_fb: post init->0

We had the problem as described above (d7), and tracked it down to the fb_user_user_logout() function.

fb_user hooks in on the user_logout invoke, but ends with a drupal_goto.. basically breaking of the normal user_logout function process.
Therefor session_destroy is never called.

Our quick fix was to add session_destroy() in fb_user_user_logout before calling the drupal_goto().
This isn't perfect as any other module that would like to hook into user_logout still doesn't have a chance to do its magic.

Patch attached (against git master branch), big ups for my man tim_dj for bughunt support :)

-- update:
This did destroy the session... but it doesn't fix the issue, back to the bughunt modus :S

-- update 2:
hrmm it works in chrome & safari but not on firefox...

@thomasedavis, I'm not sure about anything when it comes to git... it seems like there's 5 ways to do something incorrectly for every way there is to do it correctly. But I believe this is the page that represents 6.x-3.0-rc11, and not the link you provided: http://drupalcode.org/project/fb.git/shortlog/refs/tags/6.x-3.0-rc11

@andycwwai, make sure you really updated the files, and make there are not two copies of modules/fb. If using rc11, you should see ?fbu=NNNNN appended to URLs, instead of ?_fb_user_fbu=NNNN.

@thijsvdanker, try with the latest 7.x-3.0-dev build.

@dave cohen, I'm running the dev build, am I wrong on the sessions thingie?

subscribe

Hi Dave, thanks for your reply. I've noticed that after I login using facebook account, the "?fbu=NNNNNN" is appended to the URL. However, after I pressing Logout, it becomes "?_fb_user_fbu=NNNNNN" at the end of the URL. I'm sure there is only one version of modules/fb in the Drupal directory. Also, I've searched the code and found "drupal_goto($_GET['q'], array('_fb_user_fbu' => $fbu));" in fb_user.module (line 210). Is there something wrong with the version I've downloaded?

Latest D7 build.

Error message on attempted logout:

Notice: Undefined property: stdClass::$name in eval() (line 1 of /home/user/public_html/example.com/modules/php/php.module(75) : eval()'d code)

Yeah, didn't mention seeing the same as @andycwwai.

I should also mention that I'm holding launch off until these FB connect issues can be rectified. I'm hoping for a quick resolution.

Thx.

I have upgraded to rc11, and the logout problem appears to be fixed for the most part.

When the user clicks Drupal's "Logout" button in Safari, they're initially redirected to a page where they are logged out of Facebook but somehow still logged into the app/Drupal. The address bar shows the "?_fb_user_fbu=xxxxxx" that some have mentioned above. However, the page is automatically refreshed, and the user is now logged out of both app/Drupal and Facebook.

In Firefox the user is logged out of app/Drupal and Facebook immediately.

So, at least for me, it's working.

I upgraded to rc11. It didn't fix the issue for our site and further, it stopped auto-refreshing on Facebook login. I am not sure if both issues are related, but I thought to share if anybody else started to notice same issue with the upgrade.

upgraded to RC11. When I logout it goes to whatever the is, but appends ?_fb_user_fbu=(my_fb_account), then it reloads the page and places the ?fbu=(my_fb_account). Don't know if that is helpful.

user.module line 143..
if (isset($_REQUEST['_fb_user_fbu']))
I just changed this to 'fbu' instead an dit fixed my extra redirect I mentioned above. Still have the not logout issue though

I was mistaken in #61, the ?_fb_user_fbu= is not what changed in RC11, it was ?_fb_js_fbu= that changed to ?fbu=. I know all this sounds complicated and maybe it is more complicated that it has to be. This code has changed along with changes to facebook platform and various bug fixes. Also complicated because it is supposed to work with both canvas pages and facebook connect, and both with third-party cookies are enabled or not.

The ?fbu= part of the URL indicates that facebook's Javascript SDK believes the session has changed. The ?_fb_user_fb= indicates that facebook's PHP SDK believes the session has changed. Those SDKs also honor both cookies and session data passed in.

For those still experiencing the problem, I recommend clearing all cookies, looking for javascript errors (firebug or similar tool), and also trying on http://www.drupalforfacebook.org. If anyone reproduces the problem there, I'd like to know what browser and third-party cookies setting you are using. If you can reproduce it locally but not on drupalforfacebook.org, maybe some third-party module is causing a problem (login tobaggon, global redirect, maybe something else).

Here's a patch which in my testing avoids the extra redirect when logging out.

Works. So far so good.

Thanks, Dave!

Hi Dave, I noticed the following differences between drupalforfacebook.org and my site:

1) after login, by the end of url:
- my site: keep showing "?fbu=NNNNNN"
- drupalforfacebook.org: changing from "?fbu=NNNNNN" to "?_fb_user_fbu=NNNNNN"
2) after pressing logout:
- my site: refresh and showing "?_fb_user_fbu=NNNNNN" and then stop loading
- drupalforfacebook.org: refresh and showing showing "?_fb_user_fbu=NNNNNN", then changed to "?fbu=0" and then showing the progress bar, after that the "... connected" message will become the facebook login button
(i.e. successful logout)

I think some of the scripts/php are not being run in my case and still keeping as logged in (but there is no error show in firebug). I've tried to look at the codes and cannot find the way. I also noticed that the jquery version for my site is 1.3.2 and yours is 1.2.6. Is jquery 1.3.2 not supported?

Sorry for keep asking as I really want to figure it out.

This seems to be working for most users, so I no longer consider it the critical bug it once was.

@andycwwai, do you have any third-party modules enabled that might affect this, like login tobaggon or global redirect? I doubt the jquery version is the problem.

This is still affecting my sites.

Thanks eelke, I believe you have it right.

The patch in #72 helps, in that if the user clicks logout on your drupal site, they will be logged out.

However if they log out of facebook (or another facebook connect site), the normal auth.sessionChange event never fires, so they will remain logged into drupal indefinately. Sucks, but at the moment I'm not sure how to fix. I asked for help on facebook forum. That rarely gets results, but we'll see.

OK, here's what I'm currently testing. I think it fixes it. (Javascript checks the login status with facebook on every page load, which is not ideal, but hopefully not a problem.)

Hi Dave, I've followed eelke to remove the offline access in facebook and it do able to logout. Many thanks for your efforts and response.

Also, thanks eelke for your findings.

Hi Dave,

The fix in #80 eliminates the error message, so that's great. I can go live with things as is.

Not perfect yet though. Here's the behavior I get:

When a user logs out, the page refreshes, is not logged out yet, then refreshes again and is logged out.

Also, when a user logs in using the non-FB site credentials in the log-in user fields instead of the Connect button, the user is not logged in via FB- even if the account is connected with a FB account and FB is logged in in another tab. Either the user has to log out and log in again using the Connect button, or has to find some FB widget on the page and log in a second time using FB.

Also, when a user logs in using the non-FB site credentials in the log-in user fields instead of the Connect button, the user is not logged in via FB- even if the account is connected with a FB account and FB is logged in in another tab. Either the user has to log out and log in again using the Connect button, or has to find some FB widget on the page and log in a second time using FB.

That's expected. There's no way to log you into facebook unless you log in yourself.

Thanks Dave, #80 works well for me.

Thanks Dave for the patch #80. It works for Chrome & Safari but for Firefox (4.0), FBConnect login requires the page refresh and after logout, it doesn't clear the session and fb user logs back in automatically.

Thanks very much, fix #80 work for me

a gifted American herve leger psychologist has said, 'Worry is herve leger dress a spasm of the emotion; the mind catches herve leger dresses hold of something Herve Leger Bandage and will Herve Leger Bandage Dressnot let it go.' It is useless to argue with the mind in this condition. The Herve Leger Sale stronger the will, the more futile the task. One can only gently insinuate something else into its convulsive grasp. And if this Cheap Herve Leger something else is rightly chosen, if it really Herve Leger Dresses attended by the illumination of another field of interest, gradually, and often quite swiftly, the Herve Leger Strapless old undue grip relaxes and the process Herve Leger Skirts of recuperation and repair begins.

Committed patch #80.

Sorry,
which version is installed on drupalforfacebook.org?
When I try to logout, it seems like the issue persists.. after a reload, I'm logged in again...so on one of my last sites http://www.smartips.net (with rc11)

Drupalforfaceboook.org uses a recent copy of 6.x-3.x-dev. Please explain how to reproduce the problem there. I just tried and it logs out correctly. Besides, it does not prompt for the offline_access permission, so if there is a problem there it would be another issue.

I get the same issue. Happens after first recognition of my facebook account session or if i use the Connect button to login. Never logs back out for some reason.

I also noticed that this seems to be browser specific, because I can pull up Chrome or IE or another browser and get the logged-off UI.

Hope this helps.

Thanks

If I open firefox, go to http://www.drupalforfacebook.org, click the connect button and login, everything works fine so far. Then I click log out, the page refreshes and I am logged out of both the site and facebook. All as expected.

If I'm missing something, please explain how to reproduce, in a new thread. This thread is for problems related to the offline_access permission (and those problems are fixed AFAIK).

Thanks for the work on this issue. I can confirm that for my D7 Implementation, with offline_access permitted, the patch on #80 (manually implemented for D7) fixed the logout issue.

On FF 3.6.x, it skips the confirmation and immediate logs me out of Drupal and Facebook.

On IE 8, it also immediately logs me out of Drupal and facebook.

Also, noted that a few page refreshes were needed to load the new JS and behaviors, but once loaded (or reset) it works great.

Thank you.

I'm using Mac Os X Snow Leopard, version 10.6.7

I tried to follow these steps (10 minutes ago)

1)empty the browser cache
2) open www.facebook.com
3) login on facebook
4)open www.drupalforfacebook.org
5) autorefresh takes place, then i'm logged in
6)try to disconnect (pressing "Log out" link on the left box)

now.. with Chrome 11.0.696.65:
7) Logout works fine. The button "Connect with Facebook" appears.

with Firefox 4.0.1:
7) at first, it seems that i'm logged out.. suddenly there's a new refresh, and i'm logged in again.

I can confirm this is happening for me with Firefox 4.0.1 on Windows. (not sure about older versions of FF)

I think I may have figured it out.

in fb_connect.js, on line 20 a click handler is added to all instances of an href with "/logout" in it.
It seems, at least with FF, that the page refreshes before the FB.logout() has a chance to respond.

commenting out line 20
jQuery("a[href^='" + Drupal.settings.basePath + "logout']", context).click(FB_Connect.logoutHandler);

seems to be working for me. This will by pass logging them out with javascript, and let the /logout page handle everything. just as if the user had visited /logout directly.

I'm not sure if this breaks other things, but its now allowing me to logout using FF.

Update:
Alternatively, you can not comment out line 20, and instead add a "return false" to FB_Connect.logoutHandler, right below the line FB_JS.deleteCookie('fbs_' + Drupal.settings.fb.apikey, '/', ''); // apikey

Not sure which method is better.

Thanks for that suggestion. I'll add the return false; to FB_Connect.logoutHandler. My understanding of javascript is limited, but I don't see why it matters. Calling FB.logout() from javascript or Drupal's logout callback (because fb_user_user() logs out of facebook, too).

To reproduce this, do you have fb_user.module enabled?

Does this only occur with offline_access permission granted?

I don't logically understand why adding return false would change anything, but it doesn't hurt to add it, so I will.

Yes I have fb_user enabled.
offline_access enabled or not makes no difference for me.
This is only in FF 4.0.1 (possibly older FF versions too)

I don't logically understand it either. :)

also according to FB the FB.logout function returns a response. Possibly waiting for that response before continuing on may help? Im not sure.
http://developers.facebook.com/docs/reference/javascript/FB.logout/

See #1164048: Logout fails on Firefox for anything not related to the offline_access issue, which I consider fixed.

(sorry but this thread is already 99 comments long and most have nothing to do with this new problem.)

Why this one is closed and another drupal 7 issue is marked as duplicate leading to this thread here? Do I miss something? I can't find a D7 solution. Where can I post helping infos about the same problem (can't logout facebook user) when the D7 issue is closed and marked as duplicate leading to this closed D6 issue here?

Running patch from #80 with patch -p0 -i fb_login_status.diff is not working here on D7.4 - Error says, hunk failes at 5 and 246 of fb.js

kind regards

Don't re-open an issue unless you're certain the cause of your problem is the same. If there's doubt about that, you're better off opening a new issue. Be sure to thoroughly follow the instructions you'll see on the issue submit page.

thanks Dave