Multi tool use

Session content not being deleted with either session_destroy(); or unset

I've had this issue for a couple of days and I can't seem to fix it whatever I try.

There is a loginform that either redirects you to /dashboard or /admin depending on the data that is in the started session from my loginscript.

/dashboard

/admin

This is my structure:

index.php (contains header with connection.php and the html login form)
dashboard.php (contains header with connection.php and some irrelevant html)
admin.php (same as above)
header.php (at the top of all pages, has connection.php included at the first line).
connection.php (my connection script, with at the top line session_start();
login.php (my loginscript, this script is called with ajax so I have to add my entire connection class in here with session_start(); again at the top.
logout.php (my logout script, it kills the session and redirects to login page this is linked to in my header.php)


In my loginscript I have the following part:

if($userpassword == $getuser['password']){
if($getuser['rights'] == '1'){
$_SESSION['userdata']['user'] = 'Administrator';
$_SESSION['userdata']['rights'] = '1';
$_SESSION['userdata']['logo'] = 'assets/images/logo.png';
$loginresult = array(
'login_result' => 'success',
);
$logindata = array(
'userdata' => 'admin',
);
echo json_encode($logindata);
}else{
$_SESSION['userdata']['user'] = $getuser['name'];
$_SESSION['userdata']['rights'] = '0';
$_SESSION['userdata']['logo'] = $sessionlogo;
$loginresult = array(
'login_result' => 'success',
);
$logindata = array(
'userdata' => 'user',
);
echo json_encode($logindata);
}
}else{
$logindata = array(
'userdata' => '',
'message' => 'Wachtwoord en gebruikersnaam komen niet overeen',
);
echo json_encode($logindata);
}


In short: when a user logs in as admin they see the name Administrator and when they login with another account from my database, they see that particular name.

Administrator

My logout.php:

<?php
session_start();
unset($_SESSION['userdata']);
header("Location: http://website.nl/login");
die();
?>


I have also tried session_destroy(); instead of unset

session_destroy();

unset

Now when I login with an admin for example, it works fine, but if I then logout and login with a user, I am redirected to the correct page but I still see the name Administrator even though I'm not? This works the other way around too.

Administrator

So a session is set and filled with data, but on logging out and logging back in, that session is not replaced/deleted, it just keeps existing.

Why is that? The only thing that I can think of is my login.php that is called with ajax. It is the only place where another session_start(); is present, but if I remove it my loginscript doesn't work anymore.

session_start();

www.mysitename.nl

mysitename.nl

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.