PHP why is $_SESSION variable refusing to unset on browser close?

Question

I am relatively new to php but I am encountering an error that is about to drive me INSANE.

I am working on creating a webpage that lets you browse files on the server.

However, for some reason, the $_SESSION variable keeps itself set, EVEN AFTER BROWSER RESTARTS...

Please, I am begging you, tell me why this happens before I go insane.

This is my code:

<html>
<?php
session_start();
if(!isset($_GET['location'])) {
    header('Location: ?location=G:');
    session_unset();
}
/* THIS IS WHERE THE BUG OCCURS. THIS VARIABLE SHOULD BE EMPTY ON BROWSER OPEN!!!! ?!?!?!?! I HAVE ADDED NOTHING TO SESSION YET*/
var_dump($_SESSION);
if(!isset($_SESSION['path'])) {
                $_SESSION['path'] = array();
                $_SESSION['path'][0] = $_GET['location'];
            }
echo '<br><br><br><br><br><br>';
//* If user presses back and isn't in home folder, return to previous folder... *//
if(isset($_GET['back']) && $_GET['back'] == true && sizeof($_SESSION['path']) > 0) {
                unset($_SESSION['path'][sizeof($_SESSION['path'])-1]);
                $_GET['location'] = $_SESSION['path'][sizeof($_SESSION['path'])-1];
                header ('Location: ?back=false');
            } else {
                //*However if user hasn't pressed back make sure that session is properly updated with location *//
                if($_SESSION['path'][sizeof($_SESSION['path'])-1] != $_GET['location']) {
                    array_push($_SESSION['path'], $_GET['location']);
                }
            }
            //*Now build the link from the session path array*//
            $full_link = '';
            for($i = 0; $i < sizeof($_SESSION['path']); $i++) {
                $full_link .= $_SESSION['path'][$i];
                $full_link .= '/';
            }
            //*Get all files from link path*//
            $filesbrowsed = glob($full_link . '*');
?>
    <head>
        <meta charset "utf8">
        <title>File Browser</title>
        <link href="filebrowserstyle.css" rel="stylesheet" type="text/css">
    </head>
    <body>
        <header>
            <ul class = "navigation">
                <li><a href = "">Home</a></li>
                <li><a href = "?back=true">Back</a></li>
                <li><a href = ""></a></li>
                <li><a href = ""></a></li>
            </ul>
        </header>
        <div class = 'current_files'>
            <?php
            //* Now display all files in current path *//
            for($i = 0; $i < sizeof($filesbrowsed); $i++) {
                $filename = substr($filesbrowsed[$i], strlen($full_link), strlen($filesbrowsed[$i]) - strlen($full_link));
                echo '<div><a href = "?location=' . $filename . '/' . '">' . $filename . '</a></div>';
            }
            ?>
        </div>
    </body>
</html>

Thank you all in advance!!!

Note that if I remove a big chunk of the script the $_SESSION variable starts as an empty array as normal, and in my php.ini the session cookies time is set to 0, so the problem is somewhere in my script.... but I can't for the love of me figure out where — Randomdude, Jun 20 '18 at 09:11
You might want to avoid WRITING IN ALL CAPS because it's generally used to represent SHOUTING which makes you come across as rude. — IMSoP, Jun 20 '18 at 09:13
Meanwhile, there's a lot of code here, and it's unclear which part of it relates to your actual problem. Try to [edit] the question down to a [mcve]; the aim is for the smallest code that demonstrates the problem, with a clear description of what the current behaviour is, and what the behaviour you wanted/expected is. — IMSoP, Jun 20 '18 at 09:25
Have you tried using a different browser? IIIRC if you use something like "Restore my last session on browser start" some/all browsers still keep your cookies/sessions — brombeer, Jun 20 '18 at 09:33

score 2 · Answer 1 · answered Jun 20 '18 at 09:40

You should unset session before redirecting user to another location.

<html>
<?php
session_start();
if(!isset($_GET['location'])) {
    session_unset();
    session_destroy();
    header('Location: ?location=G:');
}
/* THIS IS WHERE THE BUG OCCURS. THIS VARIABLE SHOULD BE EMPTY ON BROWSER OPEN!!!! ?!?!?!?! I HAVE ADDED NOTHING TO SESSION YET*/
var_dump($_SESSION);

Tamas Szoke · Answer 2 · 2018-06-20T09:57:24.993

0

To delete all data in the session:

$_SESSION = [];

edited Jun 20 '18 at 09:57

answered Jun 20 '18 at 09:13

Tamas Szoke

5,426
4
24
39

I do not want the session to unset every time the user refreshes the page though... – Randomdude Jun 20 '18 at 09:17
You want it when there is no "location" in the url? – Tamas Szoke Jun 20 '18 at 09:18
To be frank that line is kind of unnecessary. I just left it there while experimenting with the issue. The main problem is that the var_dump at the start should return an empty array if I just opened the browser, but it does not. Regardless of whether I unset it with a line of code or not. Session should unset on browser close by definition.. – Randomdude Jun 20 '18 at 09:19
Sessions don't expire on the server just because the browser is closed. – Tamas Szoke Jun 20 '18 at 10:06

PHP why is $_SESSION variable refusing to unset on browser close?

2 Answers2