php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #72091 session data persistence after destroying session
Submitted: 2016-04-24 05:21 UTC Modified: 2020-12-09 17:49 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: rprporwal9 at gmail dot com Assigned: cmb (profile)
Status: Wont fix Package: Session related
PHP Version: 5.5.34 OS: Ubuntu
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: rprporwal9 at gmail dot com
New email:
PHP Version: OS:

 

 [2016-04-24 05:21 UTC] rprporwal9 at gmail dot com
Description:
------------
After session initialization we store data in session super global array but after invocation of session_destroy function which is used to destroy session data in session super global variable should also be unset simultaneously.

Otherwise there is no meaning of session_destroy if data persists in session super global variable

Also according to documentation of session_destroy function as mentioned in php.net

Destroys all data registered to a session

Hence I suggest that data should not persist after session is destroyed in super global $_SESSION variable otherwise there is no reliability of session_destroy() function.

Test script:
---------------
session_start();
$_SESSION['xyz']=99;
session_destroy();
print_r($_SESSION);


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-04-24 18:18 UTC] stas@php.net
-Type: Security +Type: Feature/Change Request
 [2016-04-24 18:18 UTC] stas@php.net
Not a security issue. 

Also, documented behavior of session_destroy.
 [2020-12-09 17:49 UTC] cmb@php.net
-Status: Open +Status: Wont fix -Assigned To: +Assigned To: cmb
 [2020-12-09 17:49 UTC] cmb@php.net
function my_special_session_destroy() {
        session_destroy();
        unset($_SESSION);
    }

Since this can easily be implemented in userland, but changing the
behavior of session_destroy() would introduce a BC break, I see no
point in this feature.  If you feel stronly that this would be an
improvement, please forward the feature request to the internals
mailing list.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 01 04:01:36 2025 UTC