2

I was successfull in setting a cookie while following this answer. PHP login system: Remember Me (persistent cookie)

I am having problem with my logout to unset/delete the cookie when logout.php is clicked.

login.php

$selector = base64_encode(random_bytes(9));
$authenticator = random_bytes(33);
$token = hash('sha256', $authenticator);
$expires = date('Y-m-d\TH:i:s', time() + 864000);

$stmt2 = $pdo->prepare("INSERT INTO auth_tokens (selector,token,userid,expires) VALUES (:selector, :token, :userid, :expires)");
$stmt2->bindParam(':selector', $selector);
$stmt2->bindParam(':token', $token);
$stmt2->bindParam(':userid', $userid);
$stmt2->bindParam(':expires', $expires);
$stmt2->execute();

setcookie(
        'remember',
         $selector.':'.base64_encode($authenticator),
         time()+86400,
         '/',
         false
);

logout.php

<?php
session_start();
$_SESSION = array();
unset($_SESSION);
if (isset($_COOKIE['remember'])) {
    unset($_COOKIE['remember']);
    setcookie('remember', '', time() - 3600, '/'); // empty value and old timestamp
}
session_destroy();
header("location:index.php");
?>

When I click logout.php and check on

home.php

if(isset($_COOKIE['remember']) ){ 
header('Location: ../testing.php');
 exit;
}

It redirects to testing.php which is not supposed to be so since I have unset the cookie. Am I supposed to delete from the record from the database too?

Ibrahimcodes
  • 45
  • 1
  • 7
  • I am using localhost and I followed this [link]( https://coderwall.com/p/prjmbq/set-a-cookie-on-localhost) – Ibrahimcodes Jul 18 '18 at 14:40
  • Are you sure that `time() - 3600` is less than the system time on your PC? Your server might, for example, be configured to use UTC, while your PC is on GMT-2. Causing a one hours mismatch between the two. – Tom Udding Jul 18 '18 at 14:50
  • @TomUdding I would guess it would be, since its all localhost he is testing this. I generally use the value of "80085" for my expire times though to be sure. – IncredibleHat Jul 18 '18 at 14:52
  • 1
    @IncredibleHat I think it is indeed the same but I always ask, just in case something got changed. – Tom Udding Jul 18 '18 at 14:53
  • 1
    @TomUdding Definitely a good note to ask. Its why I use such a super low value to ensure no timezone fiddlery... as it had bitten me in the rear in the past too. No pun intended. – IncredibleHat Jul 18 '18 at 14:55

0 Answers0