facebook app多次登录，逻辑错误

Question

I have this facebook app to show fb notifications in my website. Then i had this problem, Assume two users Alice & Bob. Alice is my website's regular user and she recommended it to Bob. She made him register on to my site from her own laptop. When bob tried to add the app, Alice's fb notifications shown up. Actually when Bob clicked the login link, since alice was already logged onto facebook it just pulled her details (same session), how to tackle this situation, Do we have to make Alice logout from facebook and make Bob login, Something like "Alice already logged in, sign in as a different user", Could somebody please suggest some solutions and how to do it.

The following is the piece of code am using for login

        require_once('sdk/src/facebook.php');

        $facebook = new Facebook(array(
          'appId'  => 'xxxxxxxxxxxxxxxx',
          'secret' => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
          'cookie' => true
        ));


        // Get User ID
        $user = $facebook->getUser();


        // Login or logout url will be needed depending on current user state.
        if ($user) {
          $logoutUrl = $facebook->getLogoutUrl();
        } else {
          $loginUrl = $facebook->getLoginUrl();
        }


        //check permissions list

        if ($user) {
            $permissions_list = $facebook->api('/me/permissions','GET', array('access_token' => $access_token));


             //check if the permissions we need have been allowed by the user
            //if not then redirect them again to facebook's permissions page
            //
            $permissions_needed = array('manage_notifications','publish_stream', 'read_stream');
            $login_url_params = array(
                        'scope' => 'manage_notifications,publish_stream,read_stream',
                        'fbconnect' =>  1,
                        'display'   =>  "page",
                        'next' => 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']
                    );
            foreach($permissions_needed as $perm) {
                if( !isset($permissions_list['data'][0][$perm]) || $permissions_list['data'][0][$perm] != 1 ) {
                    $login_url_params = array(
                        'scope' => 'manage_notifications,publish_stream,read_stream',
                        'fbconnect' =>  1,
                        'display'   =>  "page",
                        'next' => 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']
                    );
                    $login_url = $facebook->getLoginUrl($login_url_params);
                    echo $login_url;
                    header("Location: {$login_url}");
                    exit();
                }
            }               

            //if the user has allowed all the permissions we need,
            //get the information about the pages that he or she managers
            $accounts = $facebook->api(
                '/me',
                'GET',
                array(
                    'access_token' => $access_token
                )
            );              
        } 

          else {
            //if not, let's redirect to the ALLOW page so we can get access
            //Create a login URL using the Facebook library's getLoginUrl() method
            $login_url_params = array(
                'scope' => 'manage_notifications,publish_stream,read_stream',
                'fbconnect' =>  1,
                'display'   =>  "page",
                'next' => 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']
            );
            $login_url = $facebook->getLoginUrl($login_url_params);

            //redirect to the login URL on facebook
            $facebook_login = $login_url;
             echo "<a href='$login_url'>Login Facebook</a>";

Answer 1

The best thing to do would be the following:

1. When a user comes to your site, detect whether they are logged into Facebook and whether they are auth'd for your app using the Javascript SDK and the FB.getLoginStatus method.
2. If they aren't auth'd, prompt them with the Permissions dialog and encourage them to sign up.
3. If they are auth'd and logged in to FB, then automatically log them into your website. To avoid the Alice/Bob confusion, show an indicator somewhere on your website that they've been logged in as "Alice" and maybe have a link underneath that says 'Not you? Click here to login as someone else' or similar
4. If they click on this link, or they click on a Logout link on your site call the FB.logout method in the Javascript SDK which will invalidate the current access token for that user but also log them out of Facebook.

Then, you can push them back to the login/registration page after this and they will be prompted to login to their Facebook account.