Facebook PHP SDK getUser（）方法甚至在从Facebook取消授权应用程序后返回uid

Question

I'm writing a web app that uses facebook's PHP SDK. I'm using the getUser() method to authenticate users similar to this:

    $user = $this->facebook->getUser();
    $loginUrl = $this->facebook->getLoginUrl(array(
        'scope' => 'email,publish_stream',
        'redirect_uri' => base_url() . 'index.php/welcome/create'
    ));;

    if(!$user){
        /*
         * User not authenticated, present with facebook authorize dialog
         * */
        echo "<script type='text/javascript'>window.location = '$loginUrl';</script>";
        die();

What I don't understand is why getUser() continues to return my facebook uid even after I've removed the app from my facbeook privacy settings in facebook. Anyone know why?

Answer 1

This is because the user id is still in the session!

This is mainly causing an error when making calls with the me object (active access token is needed, or something like that).

One way to over come this would be:

try {
    $user_profile = $this->facebook->api('/me');
} catch (FacebookApiException $e) {
    error_log($e);
    $user = null;
    if(DESIRED_ERR_NUM && session_id()) {
        session_destroy(); // OR UNSET FB RELATED VARS ONLY
    }
    echo '<script>top.location.href = "' .  $this->facebook->getLoginUrl(array("scope"=>"publish_stream,user_about_me","redirect_uri"=>"YOUR_URL_HERE")) . '"</script>';
    exit;
}

This is NOT a working code, you need to check the error number AND if you have a session then destroy it OR just unset Facebook related vars in it.

You can check if this is true by executing:

if(session_id()) {
    session_destroy();
}

(please note that this will destroy EVERYTHING in the session not only Facebook related stuff!)

As I said this is not a working code but hopefully it will get you started (this can definitely be enhanced, pushed to the Facebook class..etc).