Forcing destruction of httpSession variables on logout

Question

I would like to store some data in the user's session specifically for when they're logged in. When logged out, I would like the session to destruct. Trawling through the code, it seems that session destruction is forced to false on logout.

yiilite framework:

public function logout($destroySession=true)

Craft UsersController:

 public function actionLogout()
 {
            craft()->userSession->logout(false);
....

I'm using the following in Craft config to force logouts and expiration after a certain amount of time, but the session doesn't get destroyed until the browser is closed.

'userSessionDuration'=>'PT20M',
'rememberedUserSessionDuration' => false,

Is there something I'm missing here, or do I have to override the event and clear the session variables myself?

Answer 1

Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the CraftSessionId cookie) so anything stored in PHP's session will remain.

If that's not the behavior you're looking for, you can make a feature request to expose this behavior via a config setting and/or write a simple plugin that listens for the userSession.onLogout event and manually destroy PHP session.