[SOLVED] Cookie woes

[bothwell]

I have a cookie-based authentication system which is sort of working. Users need the cookie to be set before they can do anything, and that works fine. The only thing is I can't clear the cookie by letting them hit a logout link.

 

if( $_REQUEST['action'] == 'logout' ) {

	setcookie ('athensuser', 'athensadmin', time() - 3600, '/backend/');
	print_r($_COOKIE);

} elseif(! empty($_GET['user']) ) {

	if( login_user($_GET['user'],$_GET['password']) ) {

		setcookie('athensuser', 'athensadmin', time() + 3600, '/backend/');

		if(! empty($_GET['referrer']) && strpos($_GET['referrer'],'/auth/') === false) {
			$redirect = $_GET['referrer'];
		} else {
			$redirect = BASE_PATH;
		}

		header('Location: '. $redirect);
		exit;
	}
}

 

When you hit the logout link, the print_r($COOKIE) shows me that my cookie name hasn't been set at all, the name of the cookie is just the name of the page that it was set on (so /backend/pagetools.php or whatever). I'm wondering if this is why I can't clear it on logout, but I don't understand why the name isn't being set in the first place when setcookie definitely has the value there. :/ Does anybody have any suggestions for me on how to get this working?

[thebadbad]

Normally you 'clear' a cookie by unset()'ting it:

 

unset($_COOKIE['athensuser']);

[Lumio]

Or rewrite it with empty values

[revraz]

By setting the time to negative, that actually deletes the cookie, which is also acceptable.

[bothwell]

That's the thing though, the cookie name isn't being set, so I can't do anything with it by name. If I do a print_r($_COOKIE['athensuser']); nothing is returned as output, and both FF and print_r($_COOKIE); are showing that the cookies are just being set like this: Array ( [/athens/backend/index_php] => [/athens/backend/pagetools_php] => [/athens/backend/] => ) depending on which path they were set on.

 

I imagine I can't clear the cookie because the name isn't set properly, but I don't understand why I haven't successfully managed to set the name. Any other ideas?

[bothwell]

Oh, God. I was never actually calling the login_user() function anywhere. I was using PHP_AUTH_USER instead that was located in a completely different function in a completely different file. I feel like such an idiot 

 

Thanks for the help, you guys - I might have been stupid, but I did learn three ways to clear a cookie! 

[thebadbad]

By setting the time to negative, that actually deletes the cookie, which is also acceptable.

 

Oh okay, didn't know that.