What is the common issue with PHP session management when trying to logout users?

The common issue with PHP session management when trying to logout users is that simply destroying the session variables may not be enough to fully log the user out. To completely logout a user, you also need to unset the session cookie. This can be done by setting the cookie expiration time to a past value. 

// Start the session
session_start();

// Unset all session variables
$_SESSION = array();

// Destroy the session
session_destroy();

// Unset session cookie
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

Keywords

PHP session logout session_destroy session_unset session management

Related Questions