Destroy session variables in another application

Question

I have two applications, one is the front end application, another is the backend one.

Each application has their own copy of identical user database. When a user logs into the front end application, I will also simultaneously log int the backend application using the web services provided by the backend application.

The question now is is it possible for me to destroy the backend session from front end application? The backend uses $_Session super global array to store all the session information. If yes, how?

Answer 1

You'll need to delete the session record from the database or the file (depending on your system's configuration).

The system likely defaults to use a file based session and you can determine the directory using the session_save_path. It's almost certainly much easier to use sessions stored in a database instead of on the file system.

Answer 2

If you can use the web service exposed by the back-end application for logging a user IN, why can't you use it to log the user OUT, as well? That way one app doesn't have to know how the other implements sessions (or have privliedges to muck around in there).

If this isn't possible, you'll have to do as acrosman suggests, and dig into the session files or database.

Answer 3

how are you relating the front-end sessions, to back-end sessions? if you keep a mapping the session name (unique value used as session ID) of the front-end and back-end sessions, then you can easily find the back-end session (it can be saved on files, or database) and then delete the session record. use this line to find out what handler is being used to store session files:

$handler = init_get('session.save_handler');

you can use this line to find out where session files are stored:

 $path = ini_get('session.save_path');

then you can delete the session file, or database record.

you can also create a web service method to destroy back-end sessions, and then call it from the front end.

Answer 4

If the two applications are in different subdomains of the same domain, you could save a cookie instructing the admin application that the user is logged out. Then have the admin application itself remove the session and the "logged out" cookie.

Answer 5

Yes it is.

I asume that you are using the same session ID name for both front and back. I think the default is PHP_SESSID. If this is the case, then all the session details will be being stored in the one location.

I am also asuming that the domain of front and back end is teh same.. if it is different, then it wont work, as web browsers will not share session information between different domains.

if you use different session ID names for front and back end, then you will have to get tricky. (the session ID for both will be in the request data, you will just have to load up both sessions and destroy them both.)

use:

session_destroy();