yesodweb/yesod — Issue #224: Facebook logout
Author: meteficha
Created: 2012-01-16 12:56:45+00:00
State: open
Labels: Bug

Hello!

Recently I've changed Facebook logout flow to log the user out from Facebook as well, please see commit 15495d621328ca2deaa245e1960218cc69401e01. This is needed because of Facebook's policy.

However, there's a catch, please bear with me:

1. User logs in Facebook.

2. User logs in your site.

3. User logs out of Facebook.

4. User tries to log out of your site.

On step 4 we currently redirect the user to Facebook's logout URL and ask Facebook to redirect the user back into our site's `LogoutR` that will delete his login info from his session. The problem is that when the user is already logged out from Facebook, then Facebook simply does not redirect him back to us! Yes, I know, this is silly.

This behaviour creates two problems:

1. The user is not able to logout from your site.

2. The user is redirected out of your site to Facebook and never redirected back.

Problem 1 is easy to solve, we just need to `deleteSession credsKey` on `Yesod.Auth.Facebook`. It would be better to create some `forceLogout :: YesodAuth m => GHandler Auth m ()` API on `Yesod.Auth` and just call it from `Yesod.Auth.Facebook`.

However, problem 2 remains and that's why I've opened this issue instead of solving problem 1 and sending a pull request. It seems to me that we'd need to somehow check if the user's FB access token is still valid before redirecting him.

Thoughts? I'd appreciate even a "sorry, no thoughts" before I try implementing my last idea above.