Clear browser session cookies on logout

Hi Ray, another issue picked up in my client's recent pen test was that "Session cookie was not changed when signing in and out of the application." At the moment it looks like the session cookie is only cleared when you close the browser, but it should clear when the user logs out. I've attached a copy of the login page, can you advise how I would change this?

Another thing they mention is "Session cookie was not validated against the web server database to confirm it was valid" - any idea how I could do this?

Can I get a copy of the logout page? That is the page that I think needs to be updated.

Yes, have attached it here.

Try adding this after line2 on the logout page:

session_destroy();

I think that will clear the session cookie.

Didn't make any difference unfortunately - the PHPSESSID is still saved in the browser after logging out.

Maybe try:

@session_start();
session_regenerate_id(true);
session_destroy();
session_commit();
session_start();

If that doesn't work, then you could try also adding:

if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

I added all the lines and it still doesn't clear the PHPSESSID info. I wonder if this is related to the other issue covered in my other posthttps://www.webassist.com/forums/posts.php?pid=234428 ?

No it isn't related. I'm not even sure why this is an issue that would need to be addressed.

The phpsessid doesn't change? Does it get set to a new value?

I've added details in the PM of what the pen test report says in relation to session management. The PHPSESSID doesn't change when I logout - have attached two screenshots of what Chrome lists when logged in, and when logged out - both are identical I think.

For some of the issues you would have to update your php.ini file and add:

php_value session.cookie_httponly 1
php_value session.cookie_secure 1

That should take care of the secure flag and http only flag.

I updated your logout.php page so it clears the old cookie. It wasn't working because it was redirecting and the cookie update happens in the header of the browser. I removed the redirect so the logout page displays and that allows the page to clear the cookie.