php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #24885 session_destroy() should optionally take session id as parameter
Submitted: 2003-07-31 09:40 UTC Modified: 2011-01-01 20:56 UTC
Votes:2
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: dan at danposluns dot com Assigned: jani (profile)
Status: Closed Package: Session related
PHP Version: 4.3.2 OS: Mac OS X (Unix)
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: dan at danposluns dot com
New email:
PHP Version: OS:

 

 [2003-07-31 09:40 UTC] dan at danposluns dot com
Description:
------------
It would be very useful to have session_destroy() 
optionally take a session id as a parameter.

This would be useful for people who want to help 
prevent hijacked sessions by using 
session_regenerate_id(). A subsequent call to 
session_destroy([previous session id]) would keep 
hijackers from using the old session file, and is much 
simpler than trying to unlink the file manually.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-04-10 04:54 UTC] mjs15451 at hotmail dot com
I came up with a solution here since the php developers don't see a need for this: http://bugs.php.net/bug.php?id=24096
 [2011-01-01 20:56 UTC] jani@php.net
-Status: Open +Status: Closed -Package: Feature/Change Request +Package: *General Issues -Assigned To: +Assigned To: jani
 [2011-01-01 20:56 UTC] jani@php.net
There's that option in session_regenerate_id() now since PHP 5.1.
 [2011-01-01 20:56 UTC] jani@php.net
-Package: *General Issues +Package: Session related
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jul 02 16:01:37 2025 UTC