Well firstly, Thank you for your reply... I was beginning to think I was on the "pay-no-mind" list on other similar forums on the web...at least whenever I brought up the Facebook API. So your comments are VERY much appreciated.
Weedpacket;11046625 wrote:Well, for one thing, all of the code that would put anything in the session has been commented out. You're doing nothing to maintain your session.
I see I chose the newbies forum wisely. I understand the concept of a session from a non-coding perspective, but when I started to write this, it became confusing to me. First... I don't know exactly when to start the session. Does one always do it at the outset of loading a page where authentication will be required? And if that is the case, then according to [man]session_start[/man] a session is created—or the current one is resumed. At one point I had
session_start()
at the beginning of the page after I return from the redirect, and I got an error that said "session already started", so I figured using session_start() more than once should be avoided.
Also, the manual says that session_start() creates a session identifier passed via a GET or POST request, or passed via a cookie. If I call session_start() at the beginning of my index.php, where is it getting its session identifier...or when does it get it?
Weedpacket;11046625 wrote:You call [man]session_start[/man] when [font=monospace]index.php[/font] is run, but nowhere else (unless there's something in the Facebook API that does that automatically, which I doubt).
No I don't think FB does this automatically.
in index.php, when it gets to this section:
[code=php]//should put this in a function
try {
$session = $helper->getSessionFromRedirect();
} catch( FacebookRequestException $ex ) {
$session = null;
// When Facebook returns an error
} catch( Exception $ex ) {
// When validation fails or other local issues
$session = null;
}
[/CODE]
I am simply checking for the possibility that the user may already be logged in. And this is another point of confusion. Just because the user is logged in, this doesn't mean I have received authorization for my "app". However, I try to get $session from the
$helper->getSessionFromRedirect()
which is a method of the FacebookRedirectLoginHelper() class (instantiated immediately above). When would I have the "session identifier" referenced in the manual?
Weedpacket;11046625 wrote:In particular, you never seem to record in the session the fact that the user has logged in (you set [font=monospace]$session[/font] in [font=monospace]index.php[/font], but you don't store it in the session, and you use it in [font=monospace]after-login.php[/font] but you never retrieve it from the session). If you don't make the effort to remember information from one request to the next then it's going to be forgotten.
But I check to see if the user has logged in within the code block above in index.php. If the user has logged in, I was under the impression that the $session variable had stored the session in the line
$session = $helper->getSessionFromRedirect()
(but of course I could be wrong). If the user has not logged in, I
include login-needed.php;
(NOTE: I renamed fbconfig.php from my last post to login_needed.php as the name no longer made sense)... and it is here where I do a proactive call to get the user to login.
The login_needed.php merely sets up the scope of permissions I want from the user, and then creates the
$loginURL
which goes to Facebook. The user logs in and is returned to my website based on the global $REDIRECT_URL which is passed when instantiating a new FacebookRedirectLoginHelper object in this section from index.php
global $REDIRECT_URL;
$REDIRECT_URL = "http://dev.resultscloud.net/Facebook/NewVersion/after_login.php";
$helper = new FacebookRedirectLoginHelper($REDIRECT_URL);
OK... now we get to the core of my problems... in the after_login.php file. [Incidentally, while I wrote some of this, about 60% of this code came from snippets intelligently pulled from around the web, making sure, of course, they were all the same version of the SDK]. When you arrive at after_login.php, the user has logged in and Facebook has returned the user to your website.
My first question at the outset (more general PHP question): How can I know what variables remain once I get to after_login.php? After all this is a redirect from Facebook... not an include or a require.
But more importantly, I do not understand why there is another object instantiaion from Class FacebookRedirectLoginHelper! Why would I do this a second time?? If I do this in index.php when I am starting the session and preparing to send the user to to go to Facebook and login...this makes sense. But, if in index.php it turns out I don't have a session, then once I send the user to FB to login and return to after_login.php, creating a new FacebookRedirectLoginHelper seems illogical. You can see that this is how it is set up in the section on this Class at the Facebook SDK documentation.
Weedpacket;11046625 wrote:Short answer, there is nothing on [font=monospace]after-login.php[/font] to restore the session state which you (should have) recorded in [font=monospace]index.php[/font]. See [man]intro.session[/man] for an introduction to PHP session handling.
Plus, if you follow the documentation, it once again does the try..catch block, and attempts to store the $session variable a
$session = $helper->getSessionFromRedirect();
.
However, I did read [man]intro.session[/man] (thank you) and I noticed it said [FONT=Franklin Gothic Medium]Please note when working with sessions that a record of a session is not created until a variable has been registered using the session_register() function or by adding a new key to the $_SESSION superglobal array. This holds true regardless of if a session has been started using the session_start() function.[/FONT]
So as far as keeping the session across the pages, do I need to use session_register()? Or rather check for valid session and then store variables in $_SESSION['xxx'] Superglobals?
Thank you for your help!
