FB Connect Login odd behavior when third party cookies disabled

Upon further investigation of the firefox issue, the browser appears to go through a cycle where it calls on_connected. Then after the page has refreshed the javascript on_not_connected is triggered and since the user actually had been logged in, it now logs them out. See the attached screenshot.

I know it may be IE just being difficult, but they still have 50% or more of the browser market looking at the stats on my non technical sites. It is good that now it is captured here that the namespace must be added to your theme. But, I wonder if it would also be possible to add something to the module? Maybe if someone enable facebook connect it could analyze the currently enable default theme and spit out a warning if it didn't have the proper thing? Seems like this is something that could save someone a lot of trouble. I know for months now I've just not bothered to try this facebook connect portion of the module thinking it was still a work in progress after seeing all these issues with it on drupalforfacebook.org itself. I think making this oddity that IE creates more in your face and proactively warning users about it there is a better chance for module adoption.

I'll continue to look into the firefox issue. It may be like the IE thing, but given that many large sites (digg.com fb connect on firefox works) are successfully using facebook connect there has to be away this can be made to work. I think firefox even works in the facebook connect module?

I would encourage you to set this back to a "bug report", if nothing else so that people who are thinking of using this module can more easily see the issues with it before doing so.

Well, I finally figured out my issues with Firefox. Dave, as you probably already figured it had to do with my environment. The issue is that I have the Web Developer toolbar for firefox and had it set to disable "external site cookies", see screenshot.

I'm not sure there is any way to guard against this and give a meaningful message to the end user that it will not work with external site cookies disabled? My thought was in the on_connected callback we could get the status again to ensure it was actually connected.

FB_Connect.on_connected = function(fbu) {
  //alert("FB_Connect.on_connected " + fbu + " settings fbu is " + Drupal.settings.fb_connect.fbu + " FB_Connect.fbu is " + FB_Connect.fbu);
   FB.Connect.get_status().waitUntilReady(function(status) {
     switch(status) {
     case FB.ConnectState.connected:
        var status = {'changed': false, 'fbu': fbu};
        if ((FB_Connect.fbu === 0 || Drupal.settings.fb_connect.fbu != fbu) &&
                        Drupal.settings.fb_connect.in_iframe != 1) {
                status.changed = true;
        }
        FB_Connect.fbu = fbu;
        $.event.trigger('fb_connect_status', status);
       break;
     case FB.ConnectState.appNotAuthorized:
     case FB.ConnectState.userNotLoggedIn:
          alert('external cookies may be disabled, redirect user to help page');
       break;
     }
   });
}

However, it seems that the state gets pulled from cache and so it doesn't actually perform the test I was hoping. I then tried wrapping the above in a forceSessionRefresh, but as this recent forum thread describes it doesn't seem to be working either.

http://forum.developers.facebook.com/viewtopic.php?pid=187665

Since both of these things now appear to be issues external to the module and can only be resolved by giving the user additional feedback. Moving the categorization to feature request.

I was thinking that this is something that should actually go in the module itself vs. a development module. This isn't something that only affects site admins, but could affect end users as well. End users who have these cookies disabled could be given a meaningful message that the facebook connect login was not going to work when they tried vs. making it look like the site doesn't work. I'm sure it is an edge case for folks to have the web developer pluggin with the external site cookies disabled like I did, but I wouldn't be surprised if other privacy or anti virus browser pluggins also block external cookies like that.

If I am able to come up with something, I'll post it back here.