jfbconnect not keeping session on window close

JFBConnect does not keep the session alive through restarts of the browser. This is intended behavior due to requirements from each of the social networks.

We do have an option, with Facebook authentication, to automatically re-authenticate users when they return to your site. You can find that setting in the Configuration -> Facebook tab. They will need to already be authenticated to Facebook.com in another tab/window.

The nice thing about single sign on though is that it should just take one or two clicks for the user to re-authenticate with their social network of choice on returning to your site.

I hope that helps explain,
Alex

I don't have a specific answer for you. Unfortunately, per Facebook's (and other social network) guidelines, we aren't supposed to automatically make requests on behalf of the user unless they are active on the site. There could be exceptions to this if we're just keeping them logged in (we don't actually have to make requests to Facebook if we were to implement a "Remember Me" type functionality).

However, how would you expect this to be presented to the user? Right now, when the user logs in with Facebook, they hit that button and authenticate. There isn't a way to associate a "Remember me" checkbox with that authentication.. so there's no way for the user to choose if they should remain logged in. It would be a big security issue if we left all users logged in, so I don't know of a way that meets your desire of keeping social users logged in, but doesn't cause other major issues.

If you have feedback or suggestions, I'm completely open to how this should work and how to indicate to the user that they will remain logged in even if they close their browser.

Thanks,
Alex

I understand your points. Unfortunately, Facebook doesn't allow the Facebook 'app' to authenticate a user via the browser on the same device. For a remember me functionality, if you have a suggestion as to how you see that working from a user-perspective to make it clear that they will remain logged in when the connect with a social network, we'd like to hear it.

With Joomla, there is a "Remember me" checkbox. We can't implement that box with social login since we redirect the user to those social networks to login. I don't know of a good way to implement a remember me functionality with social authentication that allows the user to opt-in and out. If you have ideas, please let us know how you think that should look.

Thanks,
Alex

The setting I referred to above is "Auto Login Facebook Users" in the JFBConnect -> Configuration -> Facebook area.

However, I don't know how what you mention is happening on this site. When I close the browser I'm not automatically logged in. I just tested in Firefox and Safari, so I'm not sure how you're seeing that behavior. I tested by opening the browser (it was closed), clicking the Facebook login, entering my FB credentials and authenticating. I'm logged into the site. Then, I closed Firefox and re-opened it. When I go to Sourcecoast.com, I'm not automatically logged in.

We do not have the setting I mentioned above enabled on this site, so the behavior I describe is expected here.

I hope that helps explain. Please test again with auto-login on this site as I'd like to hear if that works for you still with repeated tests.

Thanks,
Alex

Your video is interesting, but I honestly don't understand how that's happening. Do you see the same behavior in Firefox or other browsers? The odd thing I see in your video is how quickly all the tabs re-open. In the Chrome settings, there is an option for "On Startup". If that's left to "Continue where you left off", it's very possible the cookies aren't being cleared and you would then be correct that you aren't being logged off.

The auto-login feature of JFBConnect is *not* taking place in your video. If it were, you'd see the page refresh when you open it up as the auto-login in that mode works by the page loading, then having some Javascript automatically log the user in. So, the way you are being logged in there is through some other mechanism, which I think is just the fact that the session cookie is still valid even after a browser shutdown. Your Chrome Preferences may be set to not remove cookies on shutdown or the setting above may be doing it.

Please let us know what behavior you see in other browsers.

Thanks,
Alex