Clear the session cookie with the same domain on logout.

2026-09-25 21:44:42 +02:00
parent d8c05e82b1
commit 1541ab8411
1 changed files with 11 additions and 1 deletions
@@ -14,8 +14,18 @@ if (!csrf_valid($_GET['token'] ?? '')) {
 }
 if (isset($_SESSION['editor'])) {
  if (isset($_COOKIE[session_name()])) {
-    setcookie(session_name(), '', strtotime('-1 day'), '/');
+    // The browser only removes the cookie if domain, path and flags match
+    $params = session_get_cookie_params();
+    setcookie(session_name(), '', array(
+      'expires'  => strtotime('-1 day'),
+      'path'     => $params['path'],
+      'domain'   => $params['domain'],
+      'secure'   => $params['secure'],
+      'httponly' => $params['httponly'],
+      'samesite' => $params['samesite'],
+    ));
  }
+  unset($_SESSION['editor']);
  session_destroy();
 }
 delete_persistent_login();