Cant kill session even after restarting browser - php

Question

I am having an issue right now with sessions. I use a log in script to do initial authentication, and then i authenticate at the begining of each protected page, and finally i try to log out (code below).
The files exist on my server using PHP 5.6. I am using Win10 and Chrome on my pc.
SYMPTOMS:
Although session vars are destroyed, i can still use the 'back' button in my browser to view a page that does authentication. When i dump $_SESSION vars on that page (which i browsed back to using the back button of the browser) all $_SESSION var are non existent - but the page still loads.
COOKIES are still there. I have set cookie lifetime in my php ini to 1 (one second) for testing... they are still there after i supposedly delete them. Even when set to 0, they are still there after i restart the browser.
After reading symptom 1 above, i think many of you will guess, correctly, that the session is still alive and well - even after i close the browser, restart it and type the url of one of the protected pages directly in the address bar i am still able to view the page, even though the $_SESSION var that checks for authentication does not exist.
Would really appreciate advice.
LOG IN SCRIPT
//this page is called (using require_once) by the page
//that captures username and password
session_start();
//requirements
require_once "../php/path.php"; //sets the server search path
require_once "constants.php"; //does all the DEFINE stuff
require_once HTML_HEADER; //loads HTML code - doc type, head etc
require_once DATABASE; //does the dB connecting
//collect the POST
$uName = $_POST[uName];
$uPsswd = $_POST[uPsswd];
//build & execute sql query
**SQL to retreive uName and password here if match then...**
$_SESSION['approved'] = 'true';
require_once MAIN_CONTENTS; //main page after authentic log in
exit;
AUTHENTICATE CODE CALLED USING require_once BY EACH PROTECTED PAGE
if (session_status() == PHP_SESSION_NONE) {
session_start();
}//end if
//what's the time Mr Wolf?!!!
$now = time();
//although session exists, are we logged in and approved? If not kill session & eixt.
if (isset($_SESSION['approved']) && $_SESSION['approved'] != 'true'){
require_once "killSession.php";
require_once "notAuthorised.php";
exit;
}//end if
if (!isset($_SESSION['approved'])){
require_once "killSession.php";
require_once "notAuthorised.php";
exit;
}
//if session exists, how old is it? If older than 'discard_after' then kill session.
if (isset($_SESSION['discard_after']) && $now > $_SESSION['discard_after']) {
require_once "killSession.php";
require_once "notAuthorised.php";
exit;
}//end if
else {
//logged in and approved so set timeout for 15 mins
$_SESSION['discard_after'] = $now + 30;
}//end else
THE killSession FILE
//check to make sure session exists - start if not
if (session_status() == PHP_SESSION_NONE) {
session_start();
$_SESSION['approved']='false';
}//end if
//following code caused 'headers already sent...'
//if (isset($_COOKIE[session_name()])) {
//$params = session_get_cookie_params();
//setcookie(session_name(),'',time() - 172800, '/', $params['domain'], $params['secure'], isset($params['httponly']));
//}
session_unset();
session_destroy();
session_write_close();
setcookie(session_name(),'',0,'/');
session_regenerate_id(true);
?>

Answer 1

Your issue is most probably caused by the POST data still being stored in your browser. By clicking the back button, your user is authenticated again and a session is created.
To resolve this issue you can use the POST-Redirect-GET method.
<?php
// Has the session been set?
if (!isset($_SESSION)) {
session_start();
}
// If a form is submitted, add the POSt data to a session
// and redirect
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$_SESSION['login_data'] = $_POST;
unset($_POST);
header("Location: ".$_SERVER['PHP_SELF']);
exit;
}
// Check if user wants to login, authenticate and unset login data
if (isset($_SESSION['login_data'])) {
// Authenticate
unset($_SESSION['login_data']);
}
?>
<form action="" method="POST" role="form" action="<?= $_SERVER['PHP_SELF']; ?>">
<label for="username">Username</label>
<input type="text" class="form-control" id="username" placeholder="Username"
<label for="password">Password</label>
<input type="password" class="form-control" id="password" placeholder="Password">
<button type="submit" class="btn btn-primary">Authenticate</button>
</form>