W3 Total Cache Facebook Connect 1.3.1

You will need to add any necessary cookies to the rejected cookie list to ensure that logged in users do not see cached pages.

I’d love to help and put together a cookies list for all the major plugins etc. Any idea where to start from or any guidelines? FBAPIKEY_user is example no1. What about another example?

No idea where to begin, there is just too many. It’d be nice to be able to search against the entire plugin repository for a few functions that set cookies, but I don’t think that is possible.

I’m working on something already. I will update this post soon.

Ok.

Still working on it but nothing special to report. I’ve rejected the Facebook cookies and a bunch of others from Facebook. Even checked the don’t cache for logged in users button but the plugin still does.

If you submit a bug submission form I guess I can take a closer look although I use FB connect etc on my site with W3TC without issue.

Similar problem here, but a bit more severe:

if w3 total cache and wp-facebook-connect is activated, somehow my user’s session is being served to random visitors, making them able to comment as my user and access the admin control panel (NOT GOOD)

wp-facebook-connect apparently sets a fbs_<FBAPIKEY> cookie
i’ve set this cookie in page cache, to avoid caching, then loggen on with a fb user in a different browser, to see what happens.

If I connect with facebook, i get logged in, but looking in the page source, i can se this:

<!-- Performance optimized by W3 Total Cache. Learn more: https://www.w3-edge.com/wordpress-plugins/

Minified using disk
Page Caching using memcached (cookie is rejected)
Database Caching using memcached (user is logged in)
Object Caching 941/981 objects using memcached
...

so page cache is still on, but i’m logged in. (Don’t cache pages for logged in users is enabled) What to do now?

Cookie is rejected means that the page is not cached. You can be sure by looking at the time and date in the HTML comment and notice that it’s always changing for each page view.