Member Avatar for chaitu11

Edited by chaitu11
  • 2 Contributors
  • 4 Replies
  • 308 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by Dani

Dani AI

Generated

The "#=" fragment is added by Facebook's client-side OAuth/JavaScript flow; it's a browser hash Facebook uses internally and does not get sent to your server. It’s harmless for authentication but can look messy or interfere with single-page logic. Removing it on the client after the redirect is the simplest, most robust fix when you keep the Facebook JS flow.

A small client-side cleanup you can run on the page you redirect to will remove the fragment without reloading the page:

if (window.location.hash && window.location.hash.indexOf('_=_') !== -1) {
  if (history.replaceState) {
    history.replaceState(null, null, window.location.pathname + window.location.search);
  } else {
    window.location.hash = '';
  }
}

For CodeIgniter specifics and the logout problem: there are two separate concerns — local app session and the Facebook session. To log the user out of your app, remove any FB tokens and user data from the CI session and destroy the session. To log the user out of Facebook itself, use the JS SDK FB.logout(...) if you logged in with the JS flow, or use the PHP SDK/logout URL (or the Facebook logout endpoint that accepts the access token) if you used a server-side flow. Example client-side logout flow:

FB.logout(function(response) {
  // then call your CI logout endpoint to destroy the server session
  window.location = '/your/app/logout';
});

Notes and quick checklist:

  • ’s "add a # to the redirect URI" is a brittle hack; Facebook app settings expect exact redirect URLs and won’t accept a fragment there. Use client-side cleanup or switch to server-side OAuth to avoid the fragment entirely.
  • : since the fragment was handled via redirect(), the remaining logout issue usually means the FB token wasn’t revoked or the CI session wasn’t fully cleared — ensure the token is removed from session storage and test both JS and server logout paths.
  • Verify redirect URI exactness (protocol, domain, trailing slash) in the Facebook app settings and use browser devtools to watch cookies and network calls while testing.

Recommended Answers

All 4 Replies

Member Avatar for Dani

I had the same problem and I'm not using an OAuth library. Either way, I just added a # at the end of the redirect URI to clear out any other hash it wants to send you to.

Member Avatar for chaitu11

You mean in config file?
facebook.php

$config['facebook_app_id']              = 'xxxxxxx';
$config['facebook_app_secret']          = 'xxxxx

I tried both not working

$config['facebook_login_redirect_url']  = 'oauth/fbprofile#';
$config['facebook_login_redirect_url']  = 'oauth/fbprofile/#';
Edited by Dani because: Formatting fixed
Member Avatar for chaitu11

okay i solve the (redirects to #=) issue is sovled by using redirect();
But i am unable to logout also.....
can anyone say whats wrong with my facebook logout ?

Edited by chaitu11
Member Avatar for Dani

Sorry for my belated response. I wouldn't know what's wrong with it unless you show some code to investigate.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.