Hi there, I am writing an authentication script with an class Authentication who checks if a user is logged in or not.
Everything works fine, logging in, checking if logged in, checking if there is a cookie TO log in when not yet logged in, and so on.
Except one thing. When logging out, I can destroy the sessions and the user gets logged out. But he logs in immediately again because somehow the cookie survived the logout script. This is very weird since I actually destroy the cookie in the logout function.
Can you please check it for me?
Here is a snippet of the code:
// Fucntion to log the user out
public function logOut() {
// Clear sessions
unset($_SESSION["security"]);
unset($_SESSION["loggedin"]);
session_unset();
session_destroy();
// Set the user status to not logged in
$this->loggedIn = false;
// Destroy cookie
setcookie("BusinessgameRemember", "", time() - 60*60*24);
}
// Function to create a new session
public function createSession($securityCode) {
session_start(); // Activate the use of sessions
$_SESSION["loggedin"] = "true";
$_SESSION["security"] = $securityCode;
}
// Function to create a new cookie
public function createCookie($securityCode) {
// Set cookie
setcookie("BusinessgameRemember", $securityCode, time() + 60*60*24*30);
}
You can see the code that creates the sessions and the script which creates a cookie (both works fine). The logout function DOES destroy the sessions but not the cookie. Any hints? :s