php session_destroy browser remembering username and password
<p>I am using the php authentication method for digest authentication as shown on the <a href="http://php.net/manual/en/features.http-auth.php" rel="nofollow">php manual</a>. All is working well except for the logout part.</p>

<p>I am using <code>session_destroy()</code> to try and log my users out, which it does. However my problem is if the user goes to log back in before closing the browser out they are not prompted for a username and password and they are automatically logged back in with the last username and password they entered.</p>

<p>It seems the credentials are somehow being remembered by the browser. In Firefox if I manually clear "active logins" in the "clear browsing history" before trying to log back in then I am prompted for the username and password even though the user has been logged out with <code>session_destroy()</code>.</p>

<p>I am also using <a href="http://php.net/manual/en/function.session-destroy.php" rel="nofollow">an example from the php manual</a> to clear the cookie but that doesn't seem to help, it doesn't seem to be a cookie problem.</p>

<p>Here is my logout.php code</p>

<pre><code>&lt;?php
session_start();
$_SESSION = array();
//destroy cookie if it exists
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}
//destroy session
session_destroy();
header("location:form.php");
exit();
?&gt;
</code></pre>

<p>What am I missing? Thanks for any help!</p>
