会话不会在codeigniter中被破坏

Question

I am trying to unset my current logged in user's session.It's working fine if i am doing normal login but when i use remember me settings using cookies it's not being destroy.

My code for set the session and cookie is

public function login() {
    if(isset($this->session->userdata['username']) || isset($_COOKIE['user_id'])){
         $this->load->model('User');

            $p_uid = $this->User->user_login($_COOKIE['user_id'], $_COOKIE['password']);

     redirect(base_url() . "dashboard");
    }else{



    $this->form_validation->set_rules('user_id', 'User ID', 'required');
    $this->form_validation->set_rules('password', 'Password', 'required');
    if ($this->form_validation->run() == FALSE) {
        $this->load->view('login/login');

    } else {

        $user_id = $this->input->post('user_id');
        $password = $this->input->post('password');
        $this->load->model('User');

            $p_uid = $this->User->user_login($user_id, $password);
            //var_dump($p_uid);
            if ($p_uid) {
                if(isset($_POST['remember_me'])){
                    setcookie("user_id",$user_id,time()+86400*30);
                    setcookie("password",$password,time()+86400*30);

                }


               redirect(base_url() . "dashboard/");
            } else {
                $data=array(
                "error"=>"Wrong Userid Or Password"
                );
                $this->load->view('login/login',$data);
            }

    }
    }


}

And My logout Function is:

public function logout(){

    $this->load->helper('cookie');
    delete_cookie("user_id");
    delete_cookie("password");

    $this->session->unset_userdata("username");
    $this->session->sess_destroy();

    redirect(base_url());
}

Where i am doing mistake. please help. Thanks

Answer 1

I've faced the same issue a while ago. I was trying all methods which were possible. But I failed. Finally I found the solution with ob_start and ob_clean . Logout should be like this:

class controllerName extends CI_Controller
{
    function __construct()
    {
        parent::__construct();
        ob_start();
        $this->load->library('Session');
        $this->load->helper('cookie');
    }

    public function logout()
    {
        $this->load->driver('cache');   
        $user_id = array(
            'name'   => 'user_id',
            'value'  => '',
            'expire' => '0',
            'domain' => '.localhost',
            'prefix' => ''
        );

        delete_cookie($user_id);               
        $this->session->sess_destroy();
        $this->cache->clean();

        ob_clean();
        redirect(base_url());            
    }

}

---

To prevent browser back button previous page load, you should do something like this

$sess = $this->session->userdata('username');
if(empty($sess))
{
    $this->session->set_flashdata('error', 'Session has Expired. Please login');
    redirect('loginController/method'); 
}
else
{
    # success. 
    # continue the normal code here 
}

FYI: This should be added in every function or being used by a constructor to do it.

NOTE : Don't add password in cookie. Read - php cookie injection vulnerability?