Log out and destroy/end session

[oikopaul]

Hi all, first post here, and my problem is cookie related.

I have downloaded a login system from here

The login and all features work fine, until I try to log off, nothing happens, and registered person stays, and the form does not reset.

I assumed it should work as is, and have tried to resolve problem myself with no luck.

Below is the php i think might need changing etc.

session_name('tzLogin');
// Starting the session

session_set_cookie_params(2*7*24*60*60);
// Making the cookie live for 2 weeks

session_start();

if($_SESSION['id'] && !isset($_COOKIE['tzRemember']) && !$_SESSION['rememberMe'])
{
	// If you are logged in, but you don't have the tzRemember cookie (browser restart)
	// and you have not checked the rememberMe checkbox:

$_SESSION = array();
session_destroy();

// Destroy the session
}


if(isset($_GET['logoff']))
{
	$_SESSION = array();
	session_destroy();

header("Location: index.php");
exit;
}

There is plenty more if you need to see I can post.

If anyone can help me out I would really appreciate it.

Cheers

Paul

[ixalmida]

If you are controlling sessions with cookies, you need to unset the cookie as well. You can see how to do that here.

[oikopaul]

Thanks for the link ixalmida,
I was looking into this a little yesterday before I posted, not sure how to implement that in the above code...
Looking at my code it says the cookie will stay live for two weeks, to remember me should I return.
Problem is I don't really understand the php terminology too well.

I would like to end session

session_name('tzLogin');

when I log out, but keep the built in memory of me.

I tried adding tzLogin into the brackets in the following to no avail, but I'm really in the dark so is not surprising.

Eg. this

if(isset($GET['logoff']))
{
$SESSION = array();
session_destroy();

to this

if(isset($GET['logoff']))
{
$SESSION = array(tzLogin);
session_destroy();

Any more thoughts?

Cheers

Paul

[ixalmida]

Why not just set a new cookie specifically for that purpose?

setcookie('next_login', $user_name);
...
if(isset($_COOKIE['next_login']))
  $username = $_COOKIE['next_login'];

echo "<input type='text' name='username' value='$username' />";

[oikopaul]

Thanks again, couldn't make it work. Too much the novice for now.

Still remain logged in. Gonna mess with it some more.

[ixalmida]

Is your index page your login page? Or does it log users in automatically? I find that it is easiest to develop a robust session-checking function that I include and use in every page so that my security is consistent throughout. Then if any of the security checks fail, I make sure the session is destroyed and the user is sent to the login page.

So on each page I'd have something like:

include('includes/security.php');
$errmsg = session_validate();

Oh...I forgot to mention that I also have the security check process the error messages that occur from page to page as well. So my security functions look something like this:

function kill_session()
  {
  // Make sure session is started before you destroy it...
  if(! isset($_SESSION))
    session_start();
  // Get session cookie info so you can clear the cookie...
  $sessionName = session_name();
  $sessionCookie = session_get_cookie_params();
  // Destroy session...
  session_destroy();
  // Clear cookie...
  setcookie($sessionName, false, $sessionCookie['lifetime'], $sessionCookie['path'], $sessionCookie['domain'], $sessionCookie['secure']);
  // Set error message and redirect to login...
  $urlmsg = urlencode("Your session has expired. Please log in.");
  header("login.php?msg=$urlmsg");
  }

function session_validate()
  {
  if(empty($_SESSION))
    session_start();
  // Check for session expiration...
  if(empty($_SESSION["user_id"]))
    kill_session();
  // Session is valid - process error messages...
  if(! empty($_SESSION['errmsg']))
    {
    $msg = $_SESSION['errmsg'];
    // Unset the error message so it only displays once...
    unset($_SESSION['errmsg'];
    // Return the message...
    return $msg;
    }
  return null;

NOTE: I don't use cookies except to store login names, so this code is untested, but the cookie part came from the PHP manual pages.