Truly destroying a PHP Session?

by

To destroy a session you should take the following steps:

  • delete the session data
  • invalidate the session ID

To do this, I’d use this:

session_start();
// resets the session data for the rest of the runtime
$_SESSION = array();
// sends as Set-Cookie to invalidate the session cookie
if (isset($_COOKIE[session_name()])) { 
    $params = session_get_cookie_params();
    setcookie(session_name(), '', 1, $params['path'], $params['domain'], $params['secure'], isset($params['httponly']));
}
session_destroy();

And to be sure that the session ID is invalid, you should only allow session IDs that were being initiated by your script. So set a flag and check if it is set:

session_start();
if (!isset($_SESSION['CREATED'])) {
    // invalidate old session data and ID
    session_regenerate_id(true);
    $_SESSION['CREATED'] = time();
}

Additionally, you can use this timestamp to swap the session ID periodically to reduce its lifetime:

if (time() - $_SESSION['CREATED'] > ini_get('session.gc_maxlifetime')) {
    session_regenerate_id(true);
    $_SESSION['CREATED'] = time();
}

More Related Contents:

  1. how can I print multiple services in this way
  2. PHP session variable issue while using iframe
  3. Undefined index $_POST
  4. How do I expire a PHP session after 30 minutes?
  5. PHP Pass variable to next page
  6. Using sessions & session variables in a PHP Login Script
  7. PHP Session data not being saved
  8. Laravel – Session store not set on request
  9. Session data lost in Chrome only
  10. What do I need to store in the php session when user logged in?
  11. Array as session variable
  12. How to remove a variable from a PHP session array
  13. PHP Sessions with disabled cookies, does it work?
  14. How to kill a/all php sessions?
  15. PHP alternative to session_is_registered
  16. Can I use array_push on a SESSION array in php?
  17. When do I have to declare session_start();?
  18. how to pass value from one php page to another using session
  19. I cannot use mysql_* functions after upgrading PHP
  20. Call to undefined function session_register() [duplicate]
  21. Codeigniter session is not working on PHP 7
  22. Is it secure to store a password in a session? [duplicate]
  23. Is my understanding of PHP sessions correct?
  24. Do AJAX requests retain PHP Session info?
  25. Undefined index with PHP sessions
  26. Submit Multiple Forms With One Button
  27. When and where should I use session_start?
  28. How do check if a PHP session is empty? [duplicate]
  29. PHP session seemingly not working
  30. How to send cookies with file_get_contents

Leave a Comment