Take the 2-minute tour ×

I'm working with PHP and JavaScript SDKs and seeing the following issue:

I'm logged in, a fbsr_* cookie is set, I close the browser, reopen it and go to my application. The cookie is still set, so the application get's it through PHP's $_COOKIE variable and the Facebook class is able to extract a user and make API calls.

The problem is, as soon as the page is displayed in the browser and a call to FB.init is made, the cookie gets unset (by FB.Cookie.clearSignedRequestCookie()) and on subsequent requests the user will suddenly be logged out.

I guess the problem is, that the cookie is still valid, although the user's state actually differs from "logged in", which is detected and "fixed" by the JavaScript SDK - but how to check for this state in PHP? I really want to avoid an expensive call to the login URL and parsing the response or sending the user there...

What do you think? Am I missing something here? What's the best way to resolve this?


share|improve this question

1 Answer 1

As long as you rely on external party as authentication provider the only way to ensure user is logged in is to ask the provider.

You can do this only by making call to Facebook, there is no other way to check this. JS-SDK doing exactly the same to detect if user is logged in.

share|improve this answer
I am actually doing an API call, which succeeds. So the cookie seems to be valid - of course, Facebook may not know at this point that the browser was closed in the meantime. But is there any way to tell apart the state where a user makes his first request including a facebook cookie after actually logging in to facebook and after closing his browser without logging out from facebook? I guess the JS SDK compares the age of the cookie to the uptime of the browser, but that's not something I could trigger server-side... –  cschramm Mar 21 '12 at 8:46

Your Answer


