From 1541ab841186955fc41d989b5e00bded5c8c979d Mon Sep 17 00:00:00 2001
From: Timothy Allen <tim@treehouse.org.za>
Date: Fri, 25 Sep 2026 21:44:42 +0200
Subject: [PATCH] Clear the session cookie with the same domain on logout.

---
 publish/logout.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/publish/logout.php b/publish/logout.php
index 644bec1..9aeb20a 100644
--- a/publish/logout.php
+++ b/publish/logout.php
@@ -14,8 +14,18 @@ if (!csrf_valid($_GET['token'] ?? '')) {
 }
 if (isset($_SESSION['editor'])) {
   if (isset($_COOKIE[session_name()])) {
-    setcookie(session_name(), '', strtotime('-1 day'), '/');
+    // The browser only removes the cookie if domain, path and flags match
+    $params = session_get_cookie_params();
+    setcookie(session_name(), '', array(
+      'expires'  => strtotime('-1 day'),
+      'path'     => $params['path'],
+      'domain'   => $params['domain'],
+      'secure'   => $params['secure'],
+      'httponly' => $params['httponly'],
+      'samesite' => $params['samesite'],
+    ));
   }
+  unset($_SESSION['editor']);
   session_destroy();
 }
 delete_persistent_login();