Take the 2-minute tour ×

I am having some doubts about the proper facebook authorization/login flows and maybe some of you have more experience on the subject.

Basically I have a guest area on my website for non authenticated users and a button to connect through Facebook or the platform login/registration system.

As per the Facebook flow: once the guest clicks on the button, a popup dialog opens asking to login to fb (if needed) and to grant some permissions to the app. Once accepted, my website saves user data to the DB tables as if the user also registered to the website itself. This all works fine and once done, my users can navigate to the protected areas as expected.

Now... I don't totally get if it's mandatory to logout from Facebook AND to revoke permissions once the user chooses to logoff from my website or if it's allowed (and how) to simply log the user out of facebook (and so from the app) while the app still retains the user permissions.

I know this might sound like a silly question but last part of the flow is still foggy to me and i found the Facebook docs quite sparse. I hope I could explain it well enough!


share|improve this question
I'm working through some of the same issues myself - I guess you're using OAuth and the Graph API, right? –  Sean M Jan 28 '13 at 10:52
Yup. That is exactly what I'm doing. As said, I am quite satisfied of the login/registration/authorization process now and I'm just bashing some minor bugs but I'm not so sure about the logic behind the logout flow. –  Federico Stango Jan 28 '13 at 11:26
From memory, I thought that the fb model did not have any specific mechanism to support this. I think there are three options: (i) log out of fb (which fb does not want), (ii) revoke app permissions (which app dev prob does not want) or (iii) kill session between your server and client's browser (which is not really anything to do with fb). I need to do a little more digging on this. –  Sean M Jan 28 '13 at 12:17
Uhm, the three scenarios make perfect sense to me. By the way I believe the only viable one would be revoking permissions: the third scenario is a no-no as browsers usually do not allow manipulations of sessiondata/cookies coming from a different domain than the issuing one. –  Federico Stango Jan 28 '13 at 15:56
I don't think the third scenario is a no-no at all. You will have a session between the browser and your site which you can kill whenever you like - fb has no control over this. There are q's over what the benefit is - I think the basic benefit is that it means that there are fewer authenticated cookies flying around which is probably a good thing. From a user experience pov, security is important and/or you want to convey the fb login step clearly, perhaps you could use reauthentication developers.facebook.com/docs/howtos/login/client-side-re-auth –  Sean M Jan 28 '13 at 16:48

Your Answer



Browse other questions tagged or ask your own question.