What are the implications of the PHPSESSION cookie still being present after using session_destroy() in PHP?

The presence of the PHPSESSION cookie after using session_destroy() in PHP can lead to potential security risks as the session data may still be accessible. To fully remove the session cookie, you should also unset the session variables and regenerate the session ID before destroying the session. 

// Unset all session variables
$_SESSION = array();

// Delete the session cookie
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

// Destroy the session
session_destroy();

Keywords

PHPSESSION cookie session_destroy() implications presence

Related Questions