User Authentication With Apache And PHP - Time To Live
( Page 9 of 11 )

Finally, once the user has logged in, it is good practice to offer a log out button on every page. This provides the user with the ability to manually destroy the session and session variables created during the initial log-in phase, and eliminates the possibility of malicious users "spoofing" sessions.

Here's what "logout.php" looks like:

<?
// logout.php - destroys session and returns to login form

// destroy all session variables
session_start();
session_destroy();

// redirect browser back to login page
header("Location: /index.php");
?>

The session_destroy() function provides a convenient way to destroy all information in the current session.

You should also make it a point to specify a session lifetime in your PHP configuration, so that sessions are automatically destroyed if inactive for a specific period of time (thirty minutes is generally considered reasonable).

Obviously, you can also destroy a session just by closing your browser, just as with HTTP authentication.

>>> More PHP Articles          >>> More By The Disenchanted Developer, (c) Melonfire