Where is the security identity is saved (in what cookie)

[brad]

I managed to get my dual login working. On login, it creates two cookies .... security and PHPSSID. When I log out of project one it successfully removes that security cookie from site two as it should. However the login identity remains in project tow after log out. The security cookie is properly removed but the PHPSSID cookie remains.

My question is why without the security cookie is the second site still logged in? On the second site I have a flow that loads the user details and identity and if no identity exsists it logsout. But the only cookie remaining on the second site is the PHPSSID cookie. How can I clear that one? Is the security ID stored in the PHPSSID cookie as well?

[ben]

The reason site two still shows you as logged in is because the PHPSSID session on the API server is still alive. The security cookie is gone, but the PHP session still contains the identity, so your identity loader keeps finding it.

To fully log out both sites, your logout action needs to destroy the PHP session as well — not just remove the security cookie.

[brad]

Thanks Ben, so I am out of luck. But it brings up two questions:

1: What is the purpose of the security cookie then?
2: How long does the PHPSESSID session last before it expires?

[Cheese]

You can define the session expiry in settings @brad

[brad]

Thanks Cheese! However, I don't have that option.

Must be a Node/Docker thing ....

[Cheese]

You may have to make changes in your php.ini file then Brad.

Look for these two lines:

session.gc_maxlifetime = 7200
session.cookie_lifetime = 7200

You'll need to restart the server for the changes to take effect.

You could try adding them to your .htaccess file and see if that works first though.

<IfModule mod_php.c>
    php_value session.gc_maxlifetime 7200
    php_value session.cookie_lifetime 7200
</IfModule>

[brad]

@ben

The reason site two still shows you as logged in is because the PHPSSID session on the API server is still alive. The security cookie is gone, but the PHP session still contains the identity, so your identity loader keeps finding it.

I think I can live with it. One question, does the PHPSESSID expiry time/date reset on each load of a page?

[ben]

Your logout action should run Security Logout and then Remove Session. Remove Session destroys the PHP session on the server, which kills the PHPSESSID cookie.