Session clearing issue with PHP

Question

I'm using a Facebook Connect application. Imagine it's a kind of application, where users come to my site, clicks connect button, logs in to Facebook and comes back to my site and wait for another user to connect.

I'm using the offline_access parameter when connecting. Once the user is back to my site, I need to clear all the session cookies. If the session wasn't cleared successfully, and the next user comes and connects, the user will not get the Login Page, instead it immediately redirects to my response URL, after taking my last session state.

I tried these methods together to clear the session:

    if (ini_get("session.use_cookies")) {
        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000,
                  $params["path"], $params["domain"],
                  $params["secure"], $params["httponly"]);
    }
    if (isset($_SERVER['HTTP_COOKIE'])) {
        $cookies = explode(';', $_SERVER['HTTP_COOKIE']);
        foreach($cookies as $cookie) {
            $parts = explode('=', $cookie);
            $name = trim($parts[0]);
            setcookie($name, '', time()-42000);
            setcookie($name, '', time()-42000, '/');
        }
    }

With the above methods, something is working, but not all sessions are cleared, especially the Facebook domain specific cookies. So, to delete Facebook cookies, I tried the following static methods as well to test how it works. But, even this fails.

    setcookie('L', '', time()-42000,"/",".facebook.com");
    setcookie('act', '', time()-42000,"/",".facebook.com");
    setcookie('c_user', '', time()-42000,"/",".facebook.com");
    setcookie('datr', '', time()-42000,"/",".facebook.com");
    setcookie('locale', '', time()-42000,"/",".facebook.com");
    setcookie('lu', '', time()-42000,"/",".facebook.com");
    setcookie('pk', '', time()-42000,"/",".facebook.com");
    setcookie('p', '', time()-42000,"/",".facebook.com");
    setcookie('presence', '', time()-42000,"/",".facebook.com");
    setcookie('s', '', time()-42000,"/",".facebook.com");
    setcookie('sct', '', time()-42000,"/",".facebook.com");
    setcookie('x-src', '', time()-42000,"/",".facebook.com");
    setcookie('xs', '', time()-42000,"/",".facebook.com");

And finally, I tried the normal methods,

    unset($_SESSION['fb_243155855719532_access_token']);
    unset($_SESSION['fb_243155855719532_code']);
    unset($_SESSION['fb_243155855719532_user_id']);
    unset($_SESSION['fb_243155855719532_state']);

    // Finally, destroy the session.
    session_unset();
    session_destroy();exit;

Destroying session works, but still Facebook sessions are not getting cleared. If I try to clear session cookies, with the Firefox Web Dev add-on, it works very smartly.

Ben Ben · Accepted Answer · 2011-09-25T17:20:58

If the user has 'offline_access' it's currently IMPOSSIBLE to clear the session.

Calling the PHP SDK method getLoginUrl() looks as though it should work, it logs the user out of Facebook, but when returning to your own site, the session is still valid.

This is NOT how it should work at the bug has only been introduced with the latest PHP SDK v3.

I have registered a bug, please vote/add your repro to help get it fixed:

http://developers.facebook.com/bugs/250825644953332

Session clearing issue with PHP

2 Answers