Question

I have a simple login setup, where I use a cookie to store a login ID #, and with this ID, username and other information can be displayed.

So in order to logout, I run the following php script to log out:

<?php
if (isset($_COOKIE['id'])) {
setcookie("id","",1);
}
header("Location: redirectpage.html");
exit;
?>

Which basically expires the cookie. However, when I arrive at the redirect page, which has the following code:

If (isset($_COOKIE['id'])) {
//display "You are logged in already"
} else {
// show login form
}

It says I am still logged in, and moving to a different pages still says I am logged in, and displaying the cookie value gives me an actual value, meaning the cookie has not expired. I must be missing something here, but why has the cookie not expired?

Note: I changed the expiration date from time()-60 or some value to 1, but this did not change anything, and removing the if statement to just expire the cookie every time the php code runs still does not do the trick.

Answer 1

Make sure that you are trying to delete the cookie using the same parameters you used to create it. From the php manual, http://gr2.php.net/setcookie, under “common pitfalls”:

Cookies must be deleted with the same parameters as they were set
with. If the value argument is an empty string, or FALSE, and all
other arguments match a previous call to setcookie, then the cookie
with the specified name will be deleted from the remote client. This
is internally achieved by setting value to ‘deleted’ and expiration
time to one year in past.