title: PHP - why can't I get rid of this session id cookie?
body: <p>I'm trying to troubleshoot a logout function for a web app. When you're logged in, the app has several cookies set for its domain. Here's the current logout procedure:</p>
  
  <ul>
  <li>You click a link, which sends you to a logout page</li>
  <li>The logout page runs a function that calls <code>session_destroy()</code> and also loops through all the cookies for the domain and sets them to expire in the past (see code below)</li>
  <li>The logout page then redirects to a login page, which is straight HTML.</li>
  </ul>
  
  <p>At the end of this process, all the other cookies are unset, but the <code>PHPSESSID</code> cookie is still there, has the same value, and is still set to expire at the end of the session.</p>
  
  <p><strong>What am I missing here?</strong></p>
  
  <p>Here's the logout function I mentioned above:</p>
  
  <pre><code>function log_out_current_user() {
  
          // Destroy the session
          if (isset($_SESSION)) {
              session_destroy();
          }
  
          // Expire all of the user's cookies for this domain:
          // give them a blank value and set them to expire
          // in the past
          if (isset($_SERVER['HTTP_COOKIE'])) {
              $cookies = explode(';', $_SERVER['HTTP_COOKIE']);
              foreach($cookies as $cookie) {
                  $parts = explode('=', $cookie);
                  $name = trim($parts[0]);
                  setcookie($name, '', time()-1000);
                  setcookie($name, '', time()-1000, '/');
              }
              // Explicitly unset this cookie - shouldn't be redundant,
              // but it doesn't hurt to try
              setcookie('PHPSESSID', '', time()-1000);
          }
  
      }
  </code></pre>