Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I log in to a website, an active session is created on the server and my browser retains its "logged in" state by sending the identifier of that session to the server on each request.

The problem with this approach is people may be able to steal your cookies (by cookie sniffing). The question is, does logging off actually kill the cookie on the server's side or not?

I guess this depends on the server as well the server-side language. So for example, does ending a session on PHP on Apache actually make the session identifier invalid?

share|improve this question

There's no single answer for every server, but yes - that's the intent of logging out.

share|improve this answer
For the specific example of PHP on Apache, is the answer positive? – Merik Nov 7 '10 at 18:34
Also, I'm interested to know if there's a way in PHP on Apache to "change" the session ID after successful login/logout. – Merik Nov 7 '10 at 18:34
I can tell you that as a general term, "logging out" is intended to end the session. Sorry I can't help you with PHP specifically. – Kara Marfia Nov 11 '10 at 13:02

That will depend on the server-side code, but sadly it's been my experience that rarely will developers do the "right thing" unless that happens to be the easiest thing.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .