Cookie won't unset

Question

OK, I'm stumped, and have been staring at this for hours.

I'm setting a cookie at /access/login.php with the following code:

setcookie('username', $username, time() + 604800, '/');

When I try to logout, which is located at /access/logout.php (and rewritten to /access/logout), the cookie won't seem to unset. I've tried the following:

setcookie('username', false, time()-3600, '/');

setcookie('username', '', time()-3600, '/');

setcookie('username', '', 1, '/');

I've also tried to directly hit /access/logout.php, but it's not working.

Nothing shows up in the php logs.

Any suggestions? I'm not sure if I'm missing something, or what's going on, but it's been hours of staring at this code and trying to debug.

Answer 1

use sessions for authentication, don't use raw cookies

http://www.php.net/manual/en/book.session.php

Answer 2

Is there perhaps a timezone issue here? Have you tried setting using something farther in the past, like time() - (3600*24)? PHP's documentation says that the internal implementation for deleting cookies uses a timestamp of one year in the past.

Also, you should be able to use just setcookie('username', false); without passing an expiration timestamp, since that argument is optional. Maybe including it is confusing PHP somehow?

Answer 3

How you use cookies data in your application?

If you read the cookies and check if username is not false or not '', then setting it to false or '' will be sufficient, since your application will ignore the cookies value.

You better put some security in cookies value, to prevent user change it's value. You can take a look of CodeIgniter session library, see how CI protect the cookies value using hash. Unauthorized value change will detected and the cookies will be deleted.

Also, CI do this to kill the cookies:

// Kill the cookie
    setcookie(
          $this->cookie_name,
          addslashes(serialize(array())),
          (time() - 31500000),
          $this->cookie_path,
          $this->cookie_domain,
          0
        );

Answer 4

You can delete cookies from javascript as well. Check here http://www.php.net/manual/en/function.setcookie.php#96599

Answer 5

How are you determining if it unset? Keep in mind that setcookie() won't remove it from the $_COOKIE superglobal of the current script, so if you call setcookie() to unset it and then immediatly print_r($_COOKIE);, it will still show up until you refresh the page.

Try pasting javascript:alert(document.cookie); in your browser to verify you don't have multiple cookies saved. Clear all cookies for the domain you're working on to make to sure you're starting fresh. Also ini_set(E_ALL); to make sure you're not missing any notices.