ansaurus

Question

PHP Session is not destroying after user logout

Answer 1

A:

I would check what is sending the browser to the server using Fiddler and also check what information do you have stored in your session.save_path

rossoft 2009-11-05 22:54:30

Answer 2

A:

Are you sure the page isn't cached?

Write over the authentication token:

session_start();
$_SESSION['varName'] = null;
$_SESSION = array();
session_destroy();

Scott Saunders 2009-11-05 22:55:09

Answer 3

A:

however when I go back to the index.php page

Isn't the particular page just been requested from the browser cache? Do a hard refresh of the page (CTRL+F5 in most webbrowsers).

If that turns out to be the cause and you want to disable request caching, add the following set of headers to HTML <head> your page:

<meta http-equiv="cache-control" content="no-cache,no-store,must-revalidate">
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="expires" content="0">

or, in the PHP code using PHP's header() function:

header('cache-control: no-cache,no-store,must-revalidate'); // HTTP 1.1.
header('pragma: no-cache'); // HTTP 1.0.
header('expires: 0'); // Proxies.

Don't forget to clear the browser cache before testing :)

BalusC 2009-11-05 23:00:52

Answer 4

+1 A:

First, make sure you're calling session_start(); before calling session_destroy(); because it will only issue a warning if you don't.

Also, from PHP: session_destroy:

In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

Jonathan Campbell 2009-11-05 23:04:02

+1 for not calling session_start on the logout.php page.

Jonathan Kushner 2009-11-06 20:59:20

Answer 5

A:

Also worth noting about PHP sessions, session_unset() > session_destroy(); ~~I do not know why.~~ After reading the PHP Manual entry on session_destroy(), it seems to only remove data within the current context, and not actually clear it from the flat session file, so if you didn't clear the cookie you could get it right back. This seems highly counter-intuitive (as PHP often is), and might be the reason why I decided (and then promptly forgot the reason) years ago to always use session_unset() over session_destroy().

Also, make sure your redirect is occurring after you do all this session nonsense, as PHP acts in ways which not all developers expect. Best Practice, IMO, is to follow every header('Location: ...'); call with a die;

Dereleased 2009-11-06 00:21:01

Answer 6

A:

If you use only session_unset() then buggy IE still keeps data my suggestion is to use both.

Kaido 2010-02-03 10:42:04

ansaurus

tags:

views:

answers:

PHP Session is not destroying after user logout

related questions