infinite page reloads on connected page after logging out of facebook.com [#1396590]

hi,

i was experiencing a problem, that has been reported before (in different variations). i am using the latest dev version on d7 with latest facebook-php-sdk.

the problem is, that after successfully connecting the the drupal site to facebook and logging out of facebook.com the drupal site keeps reloading in some browsers. everything behaves as expected in chrome, but does not in firefox.
the main difference is that chrome adds a variable ?fbhash=0 to the url, but firefox doesn't. when i add the ?fbhash=0 to firefox manually, everything is fine.

so i took a look at what happens on cookie level:
- first thing i noticed is that facebook renamed their cookies to fbsr (instead of fbs), but adapting the module code to this didn't change anything.
- second thing to see is that on each and every page reload i recieved a new session cookie from my drupal site. so i went through the code again and found a solution:

in fb.module l.803 ff change the following:

/**
 * Helper to ensure local user is logged out, or an anonymous session is refreshed.
 */
function _fb_logout() {
	global $user;
	$tmp = NULL;
	session_destroy();
	user_module_invoke('logout', $tmp, $user);
	$user = drupal_anonymous_user();
  //next 3 lines are original code now commented out. 
  //session_destroy();
  //$GLOBALS['user'] = drupal_anonymous_user();
  //drupal_session_initialize();

actually i think the call to drupal_session_initialize(); is just a little to much of a good thing here :-) or am i missing something??

Comment	File	Size	Author
#14	drupal-for-facebook-infinite-page-reloads-1396590-14.patch	5.03 KB	agileware
#13	fbsr-cookies-D6-2.patch	4.54 KB	hacmx
#12	fbsr-cookies-D6.patch	4.13 KB	hacmx

Comments

Comment #1

mybinaryromance commented 6 January 2012 at 18:47

no, sorry, after some more testing this is not a solution. the only way to definitely kill these page reloads is adding the ?fbhash=0 to the url.

do you have any suggestions where i could put this in code, just to make sure it is set?

Comment #2

mybinaryromance commented 6 January 2012 at 18:52

and another thing:

a short version of this

global $user;
$tmp = NULL;
session_destroy();
user_module_invoke('logout', $tmp, $user);
$user = drupal_anonymous_user();

would be
user_logout();

Comment #3

m_z commented 6 January 2012 at 22:30

There are some other posts which seem to deal with the same issue (some FB changes that make infinite logout / re-login loops) and I marked them as duplicates since this issue suggests some solutions.
- http://drupal.org/node/1396640 (Drupal 6 version of fb module)
- http://drupal.org/node/1056664#comment-5437014

@bonzo meier:
Did I understand you right in #1 that your initial suggestion doesn't solve this issue? Please report here if you find a solution.

And many thanks for starting to bring some light into this problem.

Comment #4

m_z commented 6 January 2012 at 22:31

Priority:

Normal

» Major

... and I think that this issue is at least someone with "major" priority...

Comment #5

hacmx commented 6 January 2012 at 22:34

Priority:

Major

» Normal

@bonzo meier are you using offline_access permission in your app? i have this problem only when activate that permission.

Anyone know if facebook did some change in their api or sdk?

Regards!

Comment #6

Kirk commented 6 January 2012 at 22:47

I am having the same issue as the OP and I don't have offline_access enabled.

Comment #7

m_z commented 7 January 2012 at 11:28

@hacmx:
At admin/build/fb/settings in the "Sessions" fieldset all 3 checkboxes are activated at the moment in my installation where I have the ("major" ;-) logout problems since 6th January 2012.

Could you describe your settings, since you said in #5, that you don't have any problems after deactivation "offline_access" permission?

And another issue about this topic with a promising solution (but I didn't have time to test it): http://drupal.org/node/1380534

Comment #8

TS79 commented 7 January 2012 at 13:53

I have a D6 installation without any offline_access permission of the app. I activated the module setting "Append hash on javascript page reload". So ?fbhash=0 is added to URL automatically, but logout does not work in Firefox 8.0 at the moment.

Comment #9

sibani commented 8 January 2012 at 08:27

Version:	7.x-3.x-dev	» 6.x-3.2-rc3
Priority:	Normal	» Major

i am also facing the same problem with drupal 6 and drupal for facebook latest dev. ?fbhash=0 is added to URL automatically, but logout does not work and the page is reloded and it continues. the user's session is reopened and the user is never getting logged out. if anyone has any solution please help me out

Comment #10

m_z commented 9 January 2012 at 10:34

As said in #7:
You can find a solution for this issue in http://drupal.org/node/1380534#comment-5442766 - I tested it and it works fine.

But there is no patch file for it at the moment (but an instruction which lines you must change in your fb.module file).
Maybe someone of you could create a patch there and I made a suggestion for further improvement in http://drupal.org/node/1380534#comment-5446472

Should this issue be marked as duplicate or fixed?

Comment #11

james.williams

Coventry, UK

commented 9 January 2012 at 11:27

I've added a patch based on maarudth's solution there: http://drupal.org/node/1380534#comment-5446610 It's for Drupal 7, but it could be backported to D6 no doubt.