diff --git a/publish/logout.php b/publish/logout.php index 644bec1..9aeb20a 100644 --- a/publish/logout.php +++ b/publish/logout.php @@ -14,8 +14,18 @@ if (!csrf_valid($_GET['token'] ?? '')) { } if (isset($_SESSION['editor'])) { if (isset($_COOKIE[session_name()])) { - setcookie(session_name(), '', strtotime('-1 day'), '/'); + // The browser only removes the cookie if domain, path and flags match + $params = session_get_cookie_params(); + setcookie(session_name(), '', array( + 'expires' => strtotime('-1 day'), + 'path' => $params['path'], + 'domain' => $params['domain'], + 'secure' => $params['secure'], + 'httponly' => $params['httponly'], + 'samesite' => $params['samesite'], + )); } + unset($_SESSION['editor']); session_destroy(); } delete_persistent_login();