Member Avatar for chaitu11

Problem:On click logout it again shows the html page content which i dont want to show

<?php
    session_start();

    if(isset($_GET['action']) == 'logout'){

        session_destroy();

        unset($_SESSION['user']);
        unset($_SESSION['pass']);
        echo '<pre>';
        print_r($_SESSION);

        //header('location:index.php/');
        exit();
    }

    if(isset($_SESSION['user'])== ' '){
        header('location:index.php');
        exit();
    }


    if( !( isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] == "a" && $_SERVER['PHP_AUTH_PW'] == "a" ) ){
        header('WWW-Authenticate: Basic realm="My Realm"');
        header('HTTP/1.0 401 Unauthorized');
        echo 'You are not authenticated';
        exit;
    }else{
        $_SESSION['user'] = $_SERVER['PHP_AUTH_USER'];
        $_SESSION['pass'] = $_SERVER['PHP_AUTH_PW'];




?>

html code
Edited by pritaeas because: Moved to PHP. Try to post in the right forum.
  • 2 Contributors
  • 1 Reply
  • 133 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by minitauros

Dani AI

Generated

Short version: the page reappears because the logout logic is wrong and because HTTP Basic Auth (the browser) is still providing credentials. was right to flag the bad conditional — the code is comparing the result of isset() to a string — but fixing that alone won't fully solve logout when you use Basic Auth.

A robust logout handler should (1) explicitly detect the logout request, (2) clear the server session and remove the session cookie, then (3) redirect and stop further output. Example logout flow:

<?php
session_start();

if (isset($_GET['action']) && $_GET['action'] === 'logout') {
    $_SESSION = array();

    if (ini_get('session.use_cookies')) {
        $p = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
    }

    session_destroy();
    header('Location: index.php');
    exit;
}
?>

Important notes and troubleshooting:

  • Clearing $_SESSION and calling session_destroy() does not remove the browser-side session cookie unless you explicitly delete it (shown above). See the PHP docs for session_destroy() for details.
  • HTTP Basic Auth credentials are cached by the browser. PHP session cleanup will not stop the browser from resending those credentials, so the user may appear still logged in. For logoutable web apps use form-based authentication with sessions; if Basic Auth must be used, expect inconsistent logout behavior across browsers (see HTTP Authentication docs).
  • Do not store plaintext passwords in $_SESSION; store a user id and regenerate the session id on login with session_regenerate_id(true) to help prevent session fixation.

As noted, fix the conditional checks first, then apply the logout flow above and reconsider using Basic Auth if you need a reliable logout.

Member Avatar for minitauros

First thing I see is that your code is a bit.. unexpected:

Your code:

if(isset($_SESSION['user'])== ' '){
    header('location:index.php');
    exit();
}

Should be:

if(!empty($_SESSION['user'])){
    header('location:index.php');
    exit();
}

as isset() returns a true/false value, and not a string like " " (to which you are comparing it now). I suspect that you are checking for the presence of a value in $_SESSION['user'] here, which is why it should be !empty() instead of isset() (isset() is ok, too, but I think you will want to use empty() here. Check the PHP manual for the differences or ask ^^).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.