Destroying the $ _SERVER session?

Question

Ok, so I don't use any session variables, rather my code looks like this:

if (!isset($_SERVER['PHP_AUTH_USER'])) { header('WWW-Authenticate: Basic realm="Enter your Twitter username and password:"'); header('HTTP/1.0 401 Unauthorized'); echo 'Please enter your Twitter username and password to view your followers.'; exit(); } $username = $_SERVER['PHP_AUTH_USER']; $password = $_SERVER['PHP_AUTH_PW']; 

So my question is: how can I destroy this login session when the user wants to write out his (in this case) twitter login credentials?

Answer 1

All you can do is send another 401 headers. The browser usually "forgets" the old value, opens a dialog for entering another user / password, and if users then click the "abort" button, they "log out". Two disadvantages:

• The "Abort logon to logout" dialog may surprise users a bit.
• "usually" means: better not to depend on it.

edit: And the answer has already been given, Sender of HTTP authentication via PHP

Answer 2

Unable to destroy the HTTP authentication login server. This is one of the biggest disadvantages of this login form.