php - form logout without script flash

Question

Okay not sure how to word it on google so I came here.

I have a form that contains a submit button for a logout script. When you click it, if you watch the url bar you can see where the form takes you until my javascript redirect kicks in after the changes have taken effect on the session variables. What I cannot figure out is how facebook and others do this without changing pages and redirects you when the logout is done.

Answer 1

They send a ajax call to a logout script

If you use jQuery something like:

jQuery.ajax({
   "url":"http://www.myurl.com/logout.php",
   "dataType":"json",
   "success":function(response){
        if(response.loggedout) {
            window.location ="http://www.myurl.com/someotherpage.php"
        }
    }
});

where php is being used as the backend, all the logout script would have to do is log the user out, and return something like

{"loggedout":true} if the user is logged out (false instead of true, if not)

in php you can do this by

$response = array("loggedout"=>true);
echo json_encode($response);

If you are not using jQuery (like pure javascript) you will have to build a XHR request and respond to the return (google xmlheaderrequest)

Answer 2

You could also destroy the sessions before the rest of the application runs.

Since PHP is stateless, it wouldn't have ever known a session existed prior, so the application continues to run assuming the user is a "guest".

Example for a homepage:

<?php
session_start();
if(!empty($_GET['logout'])) session_destroy();

if(!empty($_SESSION['name'])) echo "Hello, {$_SESSION['name']}!";
else echo "You are not logged in, please login!";
?>

So you can visit /index.php?logout=true and it will destroy the session before the rest of the application runs.