This is the correct behavior, because the Facebook API for logging in opens a new tab with a login form. Facebook implements the OAuth2 solution and activates the implicit OAuth2 stream to authenticate the user using its API. You must use an authorization code to enter the same window, but it is unsafe for client applications because you will need a secret code that is not accessible to users.
Instead of opening a new tab, you can create an iframe with the facebook login form and close and redirect it when the user logs in.
source share