I would like to store some data in the user's session specifically for when they're logged in. When logged out, I would like the session to destruct. Trawling through the code, it seems that session destruction is forced to false on logout.

yiilite framework:

public function logout($destroySession=true)

Craft UsersController:

 public function actionLogout()

I'm using the following in Craft config to force logouts and expiration after a certain amount of time, but the session doesn't get destroyed until the browser is closed.

'rememberedUserSessionDuration' => false,

Is there something I'm missing here, or do I have to override the event and clear the session variables myself?

1 Answer 1


Currently when you manually click the logout button in Craft, it will destroy your authenticated session information (to be logged into the control panel), but keep your existing PHP session (represented by the CraftSessionId cookie) so anything stored in PHP's session will remain.

If that's not the behavior you're looking for, you can make a feature request to expose this behavior via a config setting and/or write a simple plugin that listens for the userSession.onLogout event and manually destroy PHP session.

  • I just did a test, removing the 2 cookies that Craft creates after logging in and I'm still able to access the CP. It looks like Craft is also using CraftSessionId as CP identifier as well? Removing that logs me out as expected. Feb 24, 2016 at 23:48
  • Thanks @brad, adding userSession.onLogout to my plugin achieved what I wanted.
    – Merlin
    Mar 4, 2016 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.