Preventing facebook user to automatically login my site

well i have used the facebook api couple of times. But last day i just came across a site which was really new to me. Heres the scenario

If a user is logged in at facebook and comes to my site, he will automatically be logged in without asking him and also if user logs out of my site he gets logged out of facebook. But the site i saw yesterday, they had handled it perfectly, user dose not logs in their site automatically and even if user logs out from their site, he does not gets logged out of facebook.

So any help? what is this technique 开发者_StackOverflowcalled? or any relevant help?

Best Regards

most site handled the login/authenication by using the login status of the user at facebook ends. to do what u wants, simply add an additional layer of authentication / login status checking at your own site.

The site level login status is to be retained only for the current session. In other words, once the user went away from the site, the site level login status is gone. With this, when the user returns, you know that he needs to login again.

when the user logged out from your site, you only log him out of your site and do nothing about facebook login

Using the Facebook SDK it will likely tell you the user is logged out when not logged into Facebook, which in theory is the correct behaviour of the whole system, as Facebook want user's to always be connected to Facebook, I quote facebook:

As long as the user is signed into Facebook, they are automatically signed into your site as well.

So if they aren't connected to Facebook, you aren't connected to other sites. In a way it's a deterrant and increases Facebooks market.

But anyhow, it's likely the site you are describing are implementing their own authentican system rather than using Facebook's own SDK, or if they are using the SDK they are using it in moderation and understand about cookies/the above.

The flow to allow the user to be logged into Facebook but out of your site is as so:

1. When a user logs out of their site, it will unset session data for the site's own application, and also unset Facebook cookies, etc. That way the user is still logged into Facebook but out of your site.
2. When they try to log in again, Facebook will detect no cookies are available and hence will re-authenticate and pass you onto the url as passed during the authentication process. Your site will then login the user to the site's own application, setting any session variables, etc.

you need to check how you are handling the FB logins and sessions at your end.. my guess is you check the is login at your site and there are some access_tokens which are as per your app id in the cookies of your browser which are helping you to log in ..

and when logging out from your site you are explicitly logging out the user from FB as well ( thats what you are describing atleast ) you seem to be explicitly calling logout or clearing the cookies for fb app id ..