In the case of Facebook, their SDK allows a website to determine whether a user is logged in:
FB.getLoginStatus() allows you to determine if a user is logged in to Facebook and has authenticated your app. There are three possible states for a user:
- the user is logged into Facebook and has authenticated your application (connected)
- the user is logged into Facebook but has not authenticated your application (not_authorized)
- the user is not logged into Facebook at this time and so we don't know if they've authenticated your application or not (unknown)
There will be similar methods for other social networks.
How can I hide my logged in sessions from other websites?
A good precaution you can take is to disable third party cookies in your browser. This would stop a website's HTML page with reference to a resource on Facebook or Twitter from causing your browser to send your authentication cookie with the request, so their API cannot determine whether you are logged in or not.
However, some websites attempt to circumvent this by opening a popup window which makes the request include a 1st party cookie (as it is a direct request to the social network domain), and the result of this is communicated via
window.opener to the website's domain that you are on. You may be able to block these by configuring your browser's popup blocker. However, unless you set the popup blocker to its most stringent settings, websites may be able to open the popup when you click other page elements, exposing your privacy.
If you want to completely block sites from getting your logged in session statuses you will need to use private/incognito mode (this works at the time of writing) or another browser with clean cookies and empty HTML5 local objects and you should also clear any Flash and Silverlight local storage items which can be shared between browsers. However, Facebook are not at present known to be storing data using browser plugins.