Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I log in to a website, an active session is created on the server and my browser retains its "logged in" state by sending the identifier of that session to the server on each request.

The problem with this approach is people may be able to steal your cookies (by cookie sniffing). The question is, does logging off actually kill the cookie on the server's side or not?

I guess this depends on the server as well the server-side language. So for example, does ending a session on PHP on Apache actually make the session identifier invalid?

share|improve this question

2 Answers 2

There's no single answer for every server, but yes - that's the intent of logging out.

share|improve this answer
    
For the specific example of PHP on Apache, is the answer positive? –  Merik Nov 7 '10 at 18:34
    
Also, I'm interested to know if there's a way in PHP on Apache to "change" the session ID after successful login/logout. –  Merik Nov 7 '10 at 18:34
    
I can tell you that as a general term, "logging out" is intended to end the session. Sorry I can't help you with PHP specifically. –  Kara Marfia Nov 11 '10 at 13:02

That will depend on the server-side code, but sadly it's been my experience that rarely will developers do the "right thing" unless that happens to be the easiest thing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.