What potential pitfalls should be considered when using session_destroy() in PHP?

When using session_destroy() in PHP, it is important to note that it only destroys the session data on the server, but does not unset the session cookie on the client side. This means that the session cookie may still be sent with subsequent requests, potentially leading to security vulnerabilities. To fully destroy a session, it is recommended to also unset the session cookie on the client side by setting its expiration time to a past value. 

// Destroy session data on the server
session_destroy();

// Unset session cookie on the client side
setcookie(session_name(), '', time() - 3600, '/');

Keywords

session_destroy session_unset session variables session handling PHP security

Related Questions