Facebook OAuth 2.0 PHP 注销链接不会在我的网站上注销，但它会在 facebook 上注销

Question

好吧，正如标题所示，我一直试图让 Facebook 的 OAuth 在我的 localhost/ 上运行，我一直在努力解决各种问题，但我只是不知道我的最新问题是什么，即页面加载，如果用户已登录，它会显示注销 URL 和 UID注销链接。长话短说，我似乎无法让在我的本地主机中运行的网站将我从 Facebook 和我的网站上注销！任何想法都会有很大的帮助。这是我的代码

<?php

session_start();
// store session data

include "src/facebook.php";

$facebook = new Facebook(Array(
    "appId" => "xxx",
    "secret" => "xxx"
));

$user = $facebook->getUser();

echo "UID: " . $user . "<br/>";

    // THIS WAS MY FIRST TRY WHICH DIDNT SUCCEED
// if ($user) {
//  $logoutUrl = $facebook->getLogoutUrl();
//  echo "<a href='" . $logoutUrl . "'>Logout</a>";
// } else {
//  $loginUrl = $facebook->getLoginUrl();
//  echo "<a href='" . $loginUrl . "'>Login</a>";
// }

// WITH THE ABOVE CODE I GET:

// An error occurred with PHP-SDK. Please try again later.
// API Error Code: 191
// API Error Description: The specified URL is not owned by the application
// Error Message: Invalid redirect_uri: Given URL is not allowed by the Application configuration.

    // THIS WAS MY SECOND TRY AFTER SEARCHING FOR INFO, 
    // ALL I DID WAS MANUALLY ADD THE
    // REDIRECT URI AND ADDED ? , THE REASON IS IF I DIDN'T ADD IT,
    // IT WOULD GIVE ME AN CSRF ERROR
    // STATING THAT THE STATE VALUE IS NOT CORRECT, I SEARCHED FOR THE SOLUTION
    // FOR THAT PROBLEM WITH NO LUCK SO I TRIED THIS

if ($user) {
    $logoutUrl = $facebook->getLogoutUrl();
    echo "<a href='" . $logoutUrl . "'>Logout</a>";
} else {
    $loginUrl = $facebook->getLoginUrl(Array(
        "redirect_uri" => "http://localhost/php-sdk/index.php?"
    ));
    echo "<a href='" . $loginUrl . "'>Login</a>";
}

// WITH THE ABOVE CODE I NOW GET A UID AND THE LOGOUT URL DOES APPEAR, BUT ONCE I CLICK IT
// THE USER IS LOGGED OUT LIKE HE SHOULD BUT THEN ON REDIRECT OR RELOAD THE UID STILL 
// APPEARS AND SO DOES THE LOGOUT LINK, EVEN THOUGH THE USER IS NOT LOGGED IN!!

?>

Answer 1

这是因为 facebook sdk store 在您的 PHP 会话中是 user id，而发生在 facebook 服务器上的注销过程无法为您清除。您可以通过检查var_dump($_SESSION);的输出来查看会话中保存的内容

要检测存储在会话中的 uid 是否仍处于登录状态，您可以尝试使用 SDK 对象从图形 api 中获取某些内容，例如 ($facebook->api('/me')) 并捕获异常，并在发生时清除会话。

另一种解决方案可能是将next 添加到getLogoutUrl() 调用中（就像在getLoginUrl() 中一样），当facebook 将用户发送回该url 时，您会清除会话变量。默认的 facebook 实现在 BaseFacebook 类上有 destroySession（由于某种原因未在官方 sdk 文档中列出）。