Skip to main content

Creating a Logout Page

InLogout should remove server-side session data, expire the previoussession tutorial, you protected pages so that only logged-in users could access them. In this tutorial, you will create a logout page that destroys the user's sessioncookie and returns them to the login page.

Why Do We Need Logout?

When a user logs in, their information is stored in a PHP session.

For example:

user_id = 1
username = admin

To completely signreturn the user out, we need to removea thissafe sessionpublic information.page.

Create the Logout Pagescript

Create a new file called:

logout.php

Add the following code::

<?php
session_start();

$_SESSION = [];

if (ini_get("session.use_cookies")) {
    $parameters = session_get_cookie_params();

    setcookie(
        session_name(),
        "",
        time() - 42000,
        $parameters["path"],
        $parameters["domain"],
        $parameters["secure"],
        $parameters["httponly"]
    );
}

session_destroy();

header("Location: login.php");
exit();

?>exit;

SaveClearing the$_SESSION file.

removes
values

Understanding the Code

The following line startsin the current session:request. Expiring the cookie removes the browser’s session identifier. session_destroy() removes the stored session.

Logout control

For a basic local classroom project:

session_start();

The following line removes all session data:

session_destroy();

Finally, the user is redirected back to the login page:

header("Location: login.php");
exit();

Test the Logout Page

First, log in to your application.

You should be redirected to:

http://localhost/members.php

Now manually visit:

http://localhost/logout.php

You should immediately be redirected to:

http://localhost/login.php

Verify the Session Has Been Removed

After visiting:

http://localhost/logout.php

attempt to access:

http://localhost/members.php

You should no longer have access.

Instead, you should be redirected back to:

http://localhost/login.php

This confirms that the session was successfully destroyed.

Open:

members.php

Add the following code near the bottom of the page:

<p>
    <a href="logout.php">LogoutLog out</a>
</p>

Example:

For 
<h1>Members Area</h1>

<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>

<p>User ID:
<?php echo $_SESSION["user_id"]; ?>
</p>

<p>
    <a href="logout.php">Logout</stronger design, use a> </p>POST
form

Saveand thea file.CSRF token so another website cannot trigger logout unexpectedly.

Test the Logout Link

  1. Log in.
in Openand theopen Membersa Area. Click the Logout link. Confirm you are returned to the loginprotected page. AttemptLog toout. revisituse members.php.the Back button and refresh. enter the protected URL directly. confirm the application requires login again.

You should be redirected back to the login page.

Complete logout.php FileCheck

<?php

session_start();

session_destroy();

header("Location: login.php");
exit();

?>

Complete Updated members.php File

<?php

session_start();

if (!isset($_SESSION["user_id"])) {

    header("Location: login.php");
    exit();

}

?>

<!DOCTYPE html>
<html>
<head>
    <title>Members Area</title>
</head>
<body>

<h1>Members Area</h1>

<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>

<p>User ID:
<?php echo $_SESSION["user_id"]; ?>
</p>

<p>
    <a href="logout.php">Logout</a>
</p>

</body>
</html>

You now have a complete authentication system that allows users to:

  • Register anSession accountarray is cleared.
  • Log inSession cookie is expired when cookies are used.
  • Stay loggedStored insession usingis sessionsdestroyed.
  • Access protectedRedirect pagesis followed by exit.
  • Log outProtected content is unavailable after logout.

Next tutorial: Adding Role-Based Access Control (Admin, Teacher and Student Accounts).

Back to top