Tom's Blog

So far the logout procedure from MapYourBuddies works fine. However, after one logs out the logout page of Facebook is displayed. It was our goal to not to display that page but to return to our own login page. To solve this, Joern prepared a JavaScript function which would be called while clicking on <a href="ourIndex.html" onclick="sendLogoutPost()">. It was my job to figure out what to do with this JavaScript method. In order to logout from Facebook, the following must be done: “To enable a user to logout of Facebook, POST to http://www.facebook.com/logout.php, with the parameter ‘confirm’ set to 1.” Until now we had a HTML form to do this job and it worked-- but we landed at Facebooks logout page. The first idea was to send the parameters to the Facebook PHP via an XHR post request. It took me over an hour of trial and error to finally remember that XHR requests can only be send to the host on which the calling page resides. So I thought a PHP proxy do the job. After some Googling for simulating a POST with PHP it still didn’t work. Why? How would Facebook know which user clicked to log out if the request for it comes from a people.emich.edu server? There is no user variable which can be attached to the logout string. Suppose 10 people are logged in simultaneously at MapYourBuddies and one wants to log out; how can Facebook perform the logout from the server side without any reference to the user? So the logout post must clearly originate from the browser the user is logged in. I guess the logout PHP on Facebook get the session or user id out of the browser variable or cookie and then deletes it. I think the only thing we might are able to do is to open a popup or an extra site which logs the user out while the main browser window displays our own login page.

Or has anybody another idea to approach this problem?

200703312153-30