Auth::logout(): invalidate the auth cookie

acdh-oeaw · Oct 16, 2024 · 441e649 · 441e649
1 parent 1877042
commit 441e649
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/acdhOeaw/arche/core/Auth.php b/src/acdhOeaw/arche/core/Auth.php
@@ -224,6 +224,10 @@ public function logout(string $redirectUrl = ''): void {
         unset($_SERVER['PHP_AUTH_USER'], $_SERVER['HTTP_AUTHORIZATION'], $_SERVER['AUTHORIZATION']);
         $this->controller->advertise();
 
+        if (!empty($cfg->cookie?->name)) {
+            setcookie($cfg->cookie->name, '', 1, $cfg->cookie->path ?? '/');
+        }
+
         if (!empty($redirectUrl)) {
             header("Refresh: 0; url=$redirectUrl");
         }