Creating a Logout Page

Logout should remove server-side session data, expire the session cookie and return the user to a safe public page.

Logout script

Create logout.php:

<?php
session_start();

$_SESSION = [];

if (ini_get("session.use_cookies")) {
    $parameters = session_get_cookie_params();

    setcookie(
        session_name(),
        "",
        time() - 42000,
        $parameters["path"],
        $parameters["domain"],
        $parameters["secure"],
        $parameters["httponly"]
    );
}

session_destroy();

header("Location: login.php");
exit;

Clearing $_SESSION removes values in the current request. Expiring the cookie removes the browser’s session identifier. session_destroy() removes the stored session.

Logout control

For a basic local classroom project:

<a href="logout.php">Log out</a>

For a stronger design, use a POST form and a CSRF token so another website cannot trigger logout unexpectedly.

Test

1. Log in and open a protected page.
2. Log out.
3. use the Back button and refresh.
4. enter the protected URL directly.
5. confirm the application requires login again.

Check

• Session array is cleared.
• Session cookie is expired when cookies are used.
• Stored session is destroyed.
• Redirect is followed by exit.
• Protected content is unavailable after logout.