Answers.Body: <p>Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the <code>CraftSessionId</code> cookie) so anything stored in PHP's session will remain.</p>
  
  <p>If that's not the behavior you're looking for, you can make a <a href="http://feedback.craftcms.com" rel="nofollow">feature request</a> to expose this behavior via a config setting and/or write a simple <a href="https://craftcms.com/docs/plugins" rel="nofollow">plugin</a> that listens for the <a href="https://craftcms.com/docs/plugins/events-reference#userSession-onLogout" rel="nofollow">userSession.onLogout</a> event and manually destroy PHP session.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-02-24T23:48:50.643Z
Answers.Text: I just did a test, removing the 2 cookies that Craft creates after logging in and I'm still able to access the CP. It looks like Craft is also using ``CraftSessionId`` as CP identifier as well? Removing that logs me out as expected.
Answers.UserDisplayName: RitterKnight
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-04T09:54:32.813Z
Answers.Text: Thanks @brad, adding `userSession.onLogout` to my plugin achieved what I wanted.
Answers.UserDisplayName: Merlin
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-02-24T18:34:15.943Z
Answers.LastActivityDate: 2016-02-24T18:34:15.943Z
Answers.UserDisplayName: Brad Bell
Body: <p>I would like to store some data in the user's session specifically for when they're logged in. When logged out, I would like the session to destruct. Trawling through the code, it seems that session destruction is forced to false on logout.</p>
  
  <p>yiilite framework:</p>
  
  <pre><code>public function logout($destroySession=true)
  </code></pre>
  
  <p>Craft <code>UsersController</code>:</p>
  
  <pre><code> public function actionLogout()
   {
              craft()-&gt;userSession-&gt;logout(false);
  ....
  </code></pre>
  
  <p>I'm using the following in Craft config to force logouts and expiration after a certain amount of time, but the session doesn't get destroyed until the browser is closed.</p>
  
  <pre><code>'userSessionDuration'=&gt;'PT20M',
  'rememberedUserSessionDuration' =&gt; false,
  </code></pre>
  
  <p>Is there something I'm missing here, or do I have to override the event and clear the session variables myself?</p>
  
Tags: <login><session>
Title: Forcing destruction of httpSession variables on logout
ThreadText: # Forcing destruction of httpSession variables on logout
  
  (Asked by: username_0 on 2016-02-24)
  
  I would like to store some data in the user's session specifically for when they're logged in. When logged out, I would like the session to destruct. Trawling through the code, it seems that session destruction is forced to false on logout.
  
  yiilite framework:
  
  ```
  public function logout($destroySession=true)
  
  ```
  
  Craft `UsersController`:
  
  ```
   public function actionLogout()
   {
              craft()->userSession->logout(false);
  ....
  
  ```
  
  I'm using the following in Craft config to force logouts and expiration after a certain amount of time, but the session doesn't get destroyed until the browser is closed.
  
  ```
  'userSessionDuration'=>'PT20M',
  'rememberedUserSessionDuration' => false,
  
  ```
  
  Is there something I'm missing here, or do I have to override the event and clear the session variables myself?
  
  **Tags:** login, session
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-02-24. Score: 1 | Accepted answer
  
  Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the `CraftSessionId` cookie) so anything stored in PHP's session will remain.
  
  If that's not the behavior you're looking for, you can make a [feature request](http://feedback.craftcms.com) to expose this behavior via a config setting and/or write a simple [plugin](https://craftcms.com/docs/plugins) that listens for the [userSession.onLogout](https://craftcms.com/docs/plugins/events-reference#userSession-onLogout) event and manually destroy PHP session.
  
  > **Comments:**
  > **username_2**: I just did a test, removing the 2 cookies that Craft creates after logging in and I'm still able to access the CP. It looks like Craft is also using ``CraftSessionId`` as CP identifier as well? Removing that logs me out as expected.  
  > **username_0**: Thanks @username_1, adding `userSession.onLogout` to my plugin achieved what I wanted.  
  
  ---
  
  