<p>Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the <code>CraftSessionId</code> cookie) so anything stored in PHP's session will remain.</p>

<p>If that's not the behavior you're looking for, you can make a <a href="http://feedback.craftcms.com" rel="nofollow">feature request</a> to expose this behavior via a config setting and/or write a simple <a href="https://craftcms.com/docs/plugins" rel="nofollow">plugin</a> that listens for the <a href="https://craftcms.com/docs/plugins/events-reference#userSession-onLogout" rel="nofollow">userSession.onLogout</a> event and manually destroy PHP session.</p>

CC BY-SA 3.0
2016-02-24T23:48:50.643Z
I just did a test, removing the 2 cookies that Craft creates after logging in and I'm still able to access the CP. It looks like Craft is also using ``CraftSessionId`` as CP identifier as well? Removing that logs me out as expected.
RitterKnight
CC BY-SA 3.0
2016-03-04T09:54:32.813Z
Thanks @brad, adding `userSession.onLogout` to my plugin achieved what I wanted.
Merlin
CC BY-SA 3.0
2016-02-24T18:34:15.943Z
2016-02-24T18:34:15.943Z
Brad Bell
<p>I would like to store some data in the user's session specifically for when they're logged in. When logged out, I would like the session to destruct. Trawling through the code, it seems that session destruction is forced to false on logout.</p>

<p>yiilite framework:</p>

<pre><code>public function logout($destroySession=true)
</code></pre>

<p>Craft <code>UsersController</code>:</p>

<pre><code> public function actionLogout()
 {
            craft()-&gt;userSession-&gt;logout(false);
....
</code></pre>

<p>I'm using the following in Craft config to force logouts and expiration after a certain amount of time, but the session doesn't get destroyed until the browser is closed.</p>

<pre><code>'userSessionDuration'=&gt;'PT20M',
'rememberedUserSessionDuration' =&gt; false,
</code></pre>

<p>Is there something I'm missing here, or do I have to override the event and clear the session variables myself?</p>

<login><session>
Forcing destruction of httpSession variables on logout
# Forcing destruction of httpSession variables on logout

(Asked by: username_0 on 2016-02-24)

I would like to store some data in the user's session specifically for when they're logged in. When logged out, I would like the session to destruct. Trawling through the code, it seems that session destruction is forced to false on logout.
yiilite framework:
public function logout($destroySession=true)

Craft UsersController:
 public function actionLogout()
 {
            craft()->userSession->logout(false);
....

I'm using the following in Craft config to force logouts and expiration after a certain amount of time, but the session doesn't get destroyed until the browser is closed.
'userSessionDuration'=>'PT20M',
'rememberedUserSessionDuration' => false,

Is there something I'm missing here, or do I have to override the event and clear the session variables myself?

**Tags:** login, session

---

## 1 answers

### Answer by username_1 on 2016-02-24. Score: 1 | Accepted answer

Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the `CraftSessionId` cookie) so anything stored in PHP's session will remain.

If that's not the behavior you're looking for, you can make a [feature request](http://feedback.craftcms.com) to expose this behavior via a config setting and/or write a simple [plugin](https://craftcms.com/docs/plugins) that listens for the [userSession.onLogout](https://craftcms.com/docs/plugins/events-reference#userSession-onLogout) event and manually destroy PHP session.

> **Comments:**
> **username_2**: I just did a test, removing the 2 cookies that Craft creates after logging in and I'm still able to access the CP. It looks like Craft is also using ``CraftSessionId`` as CP identifier as well? Removing that logs me out as expected.  
> **username_0**: Thanks @brad, adding `userSession.onLogout` to my plugin achieved what I wanted.  

---

