What happens to the Session Cookie when the session_destroy() function is called in PHP?

When the session_destroy() function is called in PHP, it removes all session data and destroys the session. However, the session cookie still exists on the client-side until it expires or is manually deleted. This can lead to potential security risks as the session cookie can still be used to access the session data even after it has been destroyed. To fully remove the session cookie when session_destroy() is called, you can set the cookie's expiration time to a past date using setcookie() function with a negative time value. 

session_start();

// Destroy the session
session_destroy();

// Unset all session variables
$_SESSION = array();

// Remove the session cookie
if (isset($_COOKIE[session_name()])) {
    setcookie(session_name(), '', time() - 3600, '/');
}

Keywords

Session Cookie session_destroy() PHP session management cookie handling

Related Questions