can't destoy session cookie

sfullman

I have a function which users might login, logout, and then login as a new client. I want a new session key generated each time so I can track things. I'm only trying to support IE, not NN.

To my irritation, when I attempt to use session_destroy() when they logout, I find that it doesn't "really" destroy the session; it gets rid of session vairables but doesn't unset the session cookie; the next session will have the same key value -- yuck!!!

Any ideas on how to make sure the session cookie truly gets reset each time?

Thanks,
Sam Fullman
Compass Point Media

Weedpacket

One thing you can do is kill the client's cookie by overwriting it with one that has the same name as the session ID cookie. Then it doesn't matter that the variables are still sitting on the server, 'cos the client no longer knows how to get at them.

There's code for this among the user notes on the [man]session_unset[/man] page ... I'll direct you there instead of repeating it here 'cos there are other ideas and suggestions there as well.

sfullman

Dear Weedpacket,

For the user notes on session_unset, that third comment by ks at ksweb dot de simply is telling me I can't do what I want to do, which doesn't help
As far as I'm concerned, I can't seem to get hold of the 'PHPSESSID' cookie and change it. The following script works for any other cookie besides 'PHPSESSID':

On page 1:

<?php
session_start();

//just comes up with a new value
for($i=1;$i<=strlen($_COOKIE['PHPSESSID']);$i++){
$newSAMCOOKIE .= base_convert(rand(0,16),10,16);
}
//set this new cookie value
setcookie('PHPSESSID',$newSAMCOOKIE,time()+3600);
?>

On page 2:

<?php
session_start();
echo $_COOKIE['PHPSESSID'];
?>

Call page 1, then open a new window (using Control-N so it shares the same session) and call page 2. Then refresh page 1 and call 2 again. The cookie is still the same!!

The fact is, it WORKS for anything besides 'PHPSESSID'; if I replaced that with 'sam', then $_COOKIE['sam'] could be changed.

Please tell me there's a way to change the session cookie.

Sincerely,
Sam Fullman

Weedpacket

Did you look at [man]session_id[/man] while you were there?

session_id -- Get and/or set the current session id

Looking at that and one or two other things I noticed in the list at the left, I wrote

<?php
//Simulates first page; starts a session, writes stuff.
session_start();
$_SESSION['foo']='bar';
session_write_close(); //Simulates end of first page

//Simulates second page; starts a _different_ session, writes stuff.
session_id(md5(session_id())); // Guarantees different sess_id from original.
session_start();
$_SESSION['bar']='foo';
?>

Creates two session files: one containing $_SESSION['foo']='bar', and one containing $_SESSION['bar']='foo'.

But I've never found any cause to change the session_id mid-session, however: If I want to log users I log users, if I want to log sessions I log sessions. By not confusing the to I can log both and see multiple users in a single session, or a single user over multiple sessions.