Logging out from facebook when using MVC 5 OWIN

Question

I have an MVC 5 web app that has facebook authentication set up and working nicely. User clicks "Facebook" on the login page, signs in to Facebook and that authenticates with our web site. If the user logs out, the call to AuthenticationManager.SignOut() logs out of the web site correctly, but if the user then goes back to the login page and clicks "Facebook" again they are immediately signed in without having to sign in to facebook.

So my question is, how do I configure MVC 5 OWIN facebook login so that the user is signed out of facebook when they sign out of the web site, or to put it another way, prevent caching of the authentication for the next sign in. I don't want a users facebook login to be silently cached in case they are sharing a browser with other users.

Answer 1

The only way that I know to do this would be to tie an event to your log out button or link and use the Facebook Javascript SDK to actually perform the Facebook logout for you.

<a href="/Account/Logout" id="Logout">LogOut</a>

<script type="text/javascript">
   $(function(){
      $("#Logout").on("click", function(e){
        if(confirm("This will also log you out of Facebook.  Proceed?")){
           FB.logout(function(response) {
           // Person is now logged out
           });
         }else{ 
            //do not allow the link to continue and sign our of your site.
            //This is optional and allows you to provide options
            e.PreventDefault();
         }
      });    
   });
</script>

You could actually use the confirm dialog to ask if they want to be signed out of Facebook as well. A confirm would mean yes, a not confirm would mean no, just sign me out of your site. Again, using the SDK and a little bit of control logic should provide the results you need.

Answer 2

Its been two years and If OpenID Connect is used, then a solution exists as

// POST: /Account/LogOff
    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult LogOff()
    {
        Request.GetOwinContext().Authentication.SignOut();
        return Redirect("/");
        //AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
        //return RedirectToAction("Index", "Home");
    }

Answer 3

You can't. To do so would require being able to access cookies set by facebook.com which is explicitly forbidden for security reasons: you can only access cookies on your own domain. The login with Facebook is separate from your application. The user isn't truly logging into your site. They're logging into Facebook and Facebook is simply verifying the user identity with your site. If you're truly concerned you can put a message on your sign out page reminding them to sign out of Facebook as well.

You could try recreating Facebook's log out code (doing a post to the same action they use with the same data they send). But, I'm almost positive they'll be employing some sort of CSRF protection on that, so it probably won't work.

Answer 4

Saw this thread and wanted to add to it, to help the masses.

In the guidance, "Code! MVC 5 App with Facebook, Twitter, LinkedIn and Google OAuth2 Sign-on" from Microsoft, it has the following section buried in it:

Logging off your App and Logging in With Another Account

If you log on to your app with Facebook, , and then log out and try to log in again with a different Facebook account (using the same browser), you will be immediately logged in to the previous Facebook account you used. In order to use another account, you need to navigate to Facebook and log out at Facebook. The same rule applies to any other 3rd party authentication provider. Alternatively, you can log in with another account by using a different browser.

So this behavior is by design.

To learn more about OWIN, hear is some good reading:

• http://www.asp.net/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server
• http://brockallen.com/2014/01/09/a-primer-on-external-login-providers-social-logins-with-owinkatana-authentication-middleware/

Have more links to share, but drats, reputation is not high enough yet. :)