Secure PHP Logout and Revoke Sessions Across Devices

Logging out should make the current browser stop presenting an authenticated session. Clearing a page variable is not enough: the server-side session and browser cookie both need appropriate handling.

End the current session

Start the session before output, clear the session values, expire the session cookie using the same path and domain, and destroy the server-side session. PHP's session_destroy() documentation notes that destroying session data does not itself remove the cookie or clear the in-memory $_SESSION array.

Make logout a state-changing request protected against cross-site request forgery. Redirect to a public page and ensure cached private content is not shown as if the user were still authenticated.

Handle other devices deliberately

Destroying the current PHP session does not log the account out elsewhere. If the application supports “log out all devices,” keep a server-side session or token registry, or use a revocation version checked on authenticated requests. Incrementing a per-user token version can invalidate sessions when the application verifies it consistently.

Revoke persistent-login tokens as well as normal sessions. Provide users a way to review active devices and revoke a selected entry. Do not treat a browser name or IP address as strong proof of identity.

Verify the result

Test the current device, another active device, a remembered-login cookie and a password-reset flow. Confirm that protected requests fail after revocation and that the user can sign in again normally. Session expiry, cookie scope and server-side storage all affect the result.