User Logout

Overview

Logout is the process of terminating a user’s authenticated session and clearing their state. After logging out, the user can no longer access protected pages until they log in again.

The key steps are:

1. User clicks the “Logout” button or link.
2. Server destroys the session.
3. Server clears all session data.
4. User is redirected to the login page.
5. The previous session cannot be reused.

---

Session Destruction

A proper logout must do more than just clear a variable. Four things need to happen to fully terminate a session:

1. Unset all session variables to clear the $_SESSION array.
2. Delete the session cookie from the user’s browser.
3. Destroy the session file on the server.
4. Regenerate the session ID to prevent session fixation.

This ensures that session data is cleared from memory, the cookie is removed from the browser, the session file is deleted from the server, and the old session ID cannot be reused.

In your application, SessionManager::destroy() handles all of this in a single call.

---

Logout Flow

┌─────────────────┐
│  User clicks    │
│  Logout button  │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  GET /logout    │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Destroy Session│
│  - Unset vars   │
│  - Delete cookie│
│  - Remove file  │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Show success   │
│  flash message  │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│  Redirect to    │
│  /login         │
└─────────────────┘

---

Security Note

Using a POST request for logout is recommended over GET. A GET-based logout is vulnerable to CSRF attacks where an attacker could log a user out by tricking their browser into visiting the logout URL (for example, through an image tag like <img src="/logout">). A POST request with proper CSRF protection prevents this.