session/cookie problems

hi,

i’m having problems with cookies and sessions. imagine the following: i log into my 0.9.5 modx web site, browse around, and then log out. then i revisit some of the pages i viewed when i was logged in, and modx thinks i’m still logged in (as far as $modx->getLoginUserName() and $modx->getLoginUserID()) are concerned. However, since i’m not actually logged in, I can’t view any of the secured items.

Basically, the way i’ve built the menus, this results in me not having any menu when i’ve logged out and revisited a page (i have 2 menus, one for logged in users, one for non-logged in users. since modx thinks i’m logged in, it wants to show me the menu for logged in users, but later realises i’m not, so won’t show me that menu. as a result i see nothing).

i think the problem comes because when i log out, not all of the session cookies in the browser are removed. i don’t think it’s possible to remove them all anyway. however, for some reason, the server-side sessions don’t seem to be getting destroyed. as a result, when the user revisits a page, values from $_SESSION[’webInternalKey’] are being returned. however, some session variables must be being removed since modx then enforces the security model.

is this a known issue? does anyone know how i can fix this?

thanks

You sure those pages don’t have items cached when you visited as a logged in user? Security will not be taken into account if a components output is cached in a page...

Otherwise, you need to make sure you are logged into the web context specifically, vs. mgr -- you can be logged in as one and not the other, and the cookies have nothing to do with it. Even if logging out, a session is maintained, just without the session variables that provide security clearance for each context...

the menu calls are all uncached. the problem isn’t that there is an extra menu after logging out, but that there is isn’t one at all (it should detect that the user isn’t logged in, and display the menu for non-logged in users).

as for the context, i’m just using the normal weblogin snippet to let users log in.

hmm... i’m pretty stumped...