Hi,

I have an account "A" which was created using FB connect.
I have an account "B" which is a standard drupal account.

If I visit my FB connect enabled website as anonymous user while being logged in Facebook (i.e. in another tab) I get automatically logged in (as user A), without the need of clicking the "Login via Facebook" button . I have a problem with that because it's not a user action but something completly automatic that they cannot prevent. I would expect to have to click on the "login via facebook" link to be logged in.

This is even more a problem if I visit the website as user B while being logged in Facebook. This will automatically change the current user from B to A without any message to warn me. I would here expect to keep using my user B.

I think there are two distinct problems here:
- We should be able to disable this automatic login. As I come to a website I don't want to be automatically logged in.
- FB data is retrieved even if current user is a standard drupal account, if there is any facebook session open. fb_facebook_user() will return a user fb id as explained on http://drupal.org/node/968426 but will not check if the user is the same as the currently logged in Drupal user. Is there a way to do so ? If not we should not be able to use Facebook user data. What's the best way to get FB account data for the currently logged in user only ?

Not sure if this second problem is related to https://drupal.org/node/1409730

Thanks,

Seb

Comments

Dave Cohen’s picture

Dave Cohen commented

Some people consider fb.module old fashioned in that it treats facebook connect like a single sign on. This was the original intent of facebook, although more an more sites do it differently.

The effect comes from the facebook JS SDK and the fact that it is setting cookies which it uses to determine the user's status re facebook. You may prefer the behavior if you uncheck the cookie option on admin/structure/fb/settings. That is a less-tested option, but is intended to control exactly this behavior. Please let us know if it solves for you.

This issue is really a duplicate but I don't have the previous id handy. Might mark as dup if I find that.

wanjee’s picture

wanjee commented

Hi Dave,

I unchecked the "Use FB Cookie" option but it didn't change anything to the described behavior. I still am automatically logged in my website when I'm logged in Facebook. I checked the code and the cookie value is not sent anymore to FB.init but I unfortunately see no changes. Is this possibly related to my app settings ?

Can this be related to the setting named "Use Oauth when initializing javascript. - Deprecated" ? It's checked but disabled on my website, should I "uncheck" it programmatically ?

Sorry for the duplicate, I did search but found nothing similar to this one.

Seb

Dave Cohen’s picture

Dave Cohen commented

No the oauth thing is no longer an option on the JS sdk.

have you cleared all drupal caches and also all browser cookies? Start with a clean slate and see what happens. Without the cookies, modules/fb should not know whether you've logged into facebook or not.

dev.paulson’s picture

dev.paulson commented

I also have the same problem.
The second problem is very serious.
Anyone fixed this issues?
Please describe the settings to solve it.
None of the above worked for me. Changing settings clearing cache etc.