PHP session not reinitializing after logout logic

Question

I have a problem with a session variable, I have used it well up until now but after implementing the logout logic, after relog I am unable to store my session variable again.

For the log in I use an ajax request that looks like this:

if ($row['password'] == $entered_password) {
      if (!isset($_SESSION['user_email'])) {
          $_SESSION['user_email'] = $entered_email;
      } else {
          unset($_SESSION['user_email']);
          $_SESSION['user_email'] = $entered_email;
      }
      echo "login_validated";
      exit;
    } else {
      echo "invalid_password";
      exit;
    }

and the request is:

$.post('php/login.php', {
                  emailLogin: emailLogin,
                  passwordLogin: passLogin
                }, function (responseText) {
                    if (responseText === "invalid_username") {
                        alert ("Username is invalid! Please check it again or make sure you have already registered first!");
                    } else if (responseText === "invalid_password")  {
                        alert ("Given password is incorrect! Please try again.");
                    } else if (responseText === "login_validated") {
                        window.location.href = "php/pages/expenses.php";

                    } else {
                        console.log(responseText);
                        alert ("A problem occured at te server level, please try again later! If problem persists, please contact us!");
                    }
                });

But after implementing and using the following logic for the log out, my session variable value it's not saved and displayed anymore:

 $(document).ready( function (event){
            $('#logoutButton').click(function (event) {
                event.preventDefault();
                var user_response = confirm("Are you sure you want to logout? Your current session will be closed!");
                if (user_response === true) {
                    <?php
                        if (isset($_SESSION['user_email'])) {
                            unset($_SESSION['user_email']);
                        }                            
                        session_destroy();
                    ?>
                    window.location.href = "../../index.php";
                }
            });
        });

I mention that I've first tried to use a separate file for the logout with header redirect, but was blocked by my built in adblocker similar ad-blocker error. I have supposed that maybe on my previous login actions I have made too many session variables, and proceeded to clean all my cookies. It did not had any effect. Also, read other posts and the documentation and still have no clues what I have done wrong.

Also, regarding being sure to clean all previously stored session vars, I have called once the function: http://php.net/manual/ro/function.session-unset.php session_unset. Again, no improvement seen so far. I've kept trying to read the documentation but nothing seems wrong with my code, and in aother similar forum posts I have not found anything useful. Thank you in advance!

EDIT: Short mention about the password - yes, currently they are stored in plaintext, but it is just a personal project, and upon finishing I will also implement a salt and pepper encryption on passwords.

You're mixing client-side and server-side code. The `unset()` and `session_destroy()` are done at the "page generation" (execution on server), not when the button was clicked. — Syscall, Apr 02 '18 at 20:37
I have actually kind of feared of this, but I have thought that the unset will be called only when the button is clicked... I will refactor now using a simple request to a separate logout.php file and tell you the results. — student0495, Apr 02 '18 at 20:39

score 0 · Accepted Answer · answered Apr 02 '18 at 20:56

Many thanks to you @Syscall! Almost crazed about this :) Kept everything the same, just modified the php script inside the front end to an ajax request:

`var user_response = confirm("Are you sure you want to logout? Your current session will be closed!");
if (user_response === true) {
$.ajax({url: "../logout.php", success: function(result){
console.log(result);
window.location.href = "../../index.php";
}});
}`

also added a session_start(); in the logout file. Now all the logic works, logging in, logging out, trying on different users and so on.

PHP session not reinitializing after logout logic

1 Answers1