What are the potential pitfalls of using a logout.php script for logging out of a member area?

Potential pitfalls of using a logout.php script for logging out of a member area include not properly destroying the session, leaving the user vulnerable to session hijacking. To solve this issue, make sure to destroy the session and unset any session variables before redirecting the user. 

<?php
session_start();

// Unset all session variables
$_SESSION = array();

// Destroy the session
session_destroy();

// Redirect to the login page
header("Location: login.php");
exit;
?>

Keywords

session management CSRF attacks session fixation security vulnerabilities logout functionality

Related Questions