Facebook doesn't logout completely-ios

Question

while i was trying to integrate fbsdk(facebook) to my app ,it's login session working perfectly.But while i log out from mp app,it does show log out actionsheet and i can logout it easily.But when i try to login again to the facebook it goes directly to the facebook confirmation page instead of going to the login page details.Hope your help.

codes i used for logout.

  FBSDKLoginManager *manager = [[FBSDKLoginManager alloc] init];
            [FBSDKAccessToken setCurrentAccessToken:nil];
            [FBSession.activeSession closeAndClearTokenInformation];

            NSHTTPCookieStorage *storage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
            for(NSHTTPCookie *cookie in [storage cookies])
            {
                NSString *domainName = [cookie domain];
                NSRange domainRange = [domainName rangeOfString:@"facebook"];
                if(domainRange.length > 0)
                {
                    [storage deleteCookie:cookie];
                }
            }
            [manager logOut];

Answer 1

I have reported this to Facebook both as a bug and later as a security concern (you log out of something and then you can log in later without using a password again...).

They answered that this is not a bug, but a feature. "By design".

The only way to log out seems to be to call an url from the phone: https://m.facebook.com/logout.php?h=[a 16 character long token-like string]&t=[10 char long number]&refid=[a number]

From this the "h" attribute seems to be obligatory. If you omit everything else, it still works. One problem though: I don't know what this string is. Any ideas?

Or other methods to log out?

Answer 2

Use this ... [FBSDKProfile enableUpdatesOnAccessTokenChange:YES];

Answer 3

If you want to REVOKE all permissions, then you must do this:

[[[FBSDKGraphRequest alloc] initWithGraphPath:@"me/permissions" parameters:nil 
    HTTPMethod:@"DELETE"] startWithCompletionHandler:^(FBSDKGraphRequestConnection *connection, id result, NSError *error) {
  // ...
}];

https://developers.facebook.com/docs/facebook-login/permissions/v2.4

But, even this doesn't really guarantee that your app will be removed from access to the user through Facebook, again, what you are doing is basically deactivating an active token with the facebook logout, but YOU ARE NOT removing permissions for this user through facebook.

This is sort of crappy if you really want to remove users or if users want to remove YOUR app from their Facebook account, but this as far as you can go UNLESS the user themself removes permissions in their facebook account manually, here's what facebook has to say about this:

Revoking Login

You can also let people completely de-authorize an app, or revoke login, by making a call to this Graph API endpoint:

DELETE /{user-id}/permissions

This request must be made with a valid user access token or an app access token for the current app. If the request is successful, your app receives a response of true. If the call is successful, any user access token for the person will be invalidated and they will have to log in again. Because you're de-authorizing your app, they will also have to grant access to your app as if they were logging in for the first time.

Answer 4

It dsnt happen coz facebook login is done by either Safari OR facebook app (If facebook app is installed in your phone and you have added it in settings account).

This is because, Safari holds facebook session and keeps it as cookies. And in case of Facebook app, if it is connected to settings accounts, it will continue to hold the session untill you logout manually. Logging out manually from safari or facebook app or clearing cookies of safari is the only way to logout from facebook if it is already logged in.