Proper way to set cookie expire for mac devices

Question

I have login system on one of my projects witch use my own login system and facebook login. Issue is Facebook login doesn't seems to be logging out on mac devices.

My code

session_start();

if(isset($_COOKIE['checkuserst'])) {
unset($_COOKIE['checkuserst']);
setcookie('checkuserst', '', time() - 3600, '/');
}

unset($_SESSION['username']);

header("Location:index.html");

All windows browsers cookies are expiring except for safari and in mac none of the browser cookies are expiring.

Can someone point me the correct way to fix this.

Answer 1

You should not rely on cookie expiration in the browser to determine whether a user is logged out (because it's easy for users to fabricate fraudulent cookies). Store the session expiration in $_SESSION or a database. When you receive a request, even if the cookie is present, first check the matching cookie in server storage and make sure it hasn't expired.

This way whatever happens in the browser (eg browser not deleting expired cookies) will not impact your server-side security