1

Would be potential problems if I delete wordpress_logged_in_47d1523b... cookie using javascript? Is there something additional that wp_logout does?

2
  • It runs two functions: wp_destroy_current_session() and wp_clear_auth_cookie(). User cannot access restricted content, admin area and all that good stuff without a session. That still doesn't mean that you should mess with security features without any good reasons. What's your goal?
    – N00b
    May 7, 2016 at 5:01
  • I want to logout users without making them go to wp-logout using js May 7, 2016 at 5:03

2 Answers 2

1

You can log out the current user with wp_logout() function:

I think it is much better approach. wp_logout() destroys current session, clears authorization cookie and call wp_logout action. Also, it is a pluggable function, which means can be redefined by plugins. You can miss important stuff, specially when working in combination with other plugins.

If you want to log out from JavaScript, you can execute wp_logout() using ajax (code not tested, just writted here as basic example):

add_action( 'wp_enqueue_scripts', 'cyb_enqueue_scripts' );
function cyb_enqueue_scripts() 
    wp_enqueue_script( 'cyb-ajax-logout', 'url_to_js_script', array( 'jquery' ) );
    wp_localize_script( 'cyb-ajax-logout', 'ajax_logout_params',
        array(
            'ajax_url'     => admin_url( 'admin-ajax.php' ),
            'logout_nonce' => wp_create_nonce( 'cyb-logout-nonce' ),
        )
    );
}

add_action('wp_ajax_cyb_logout', 'cyb_ajax_logout');
function cyb_ajax_logout(){
    if( check_ajax_referer( 'cyb-logout-nonce', 'logout_nonce', false ) ) {
        wp_logout();
        $reponse = array(
            'message' => __( 'You have been logged out.', 'cyb-textdomain' )
        );
        wp_send_json_success( $reponse );
    } else {
        // Ajax referer is wrong
        $reponse = array(
            'message' => __( "Unknown referer. You couldn't been logged out.", 'cyb-textdomain' )
        );
        wp_send_json_error( $reponse );
    }
}

And the js:

jQuery(document).ready(function($){
    var data = {
        action: 'cyb_logout',
        logout_nonce: ajax_logout_params.logout_nonce
    };
    $.getJSON( ajax_logout_params.ajax_url, data, function( response ) {
        if( response.success ) {
            // User has been logged out
        }
    });
});
5
  • I was driving home thinking about how could I logout using ajax and you gave me the answer without asking it :D May 7, 2016 at 16:57
  • Glad to help. If this answers your question, please consider to mark it as accepted answer so other users can find it easily.
    – cybmeta
    May 8, 2016 at 18:36
  • Does wp_logout calls wp_die ()? Is logging out the user but returning 0. Weird May 8, 2016 at 20:01
  • wp_logout() returns nothing and it doesn't call wp_die(). The 0 you get is from wp_ajax_{my_action} action. If it returns 0, it is not working, very probably because the action parameter sent in the ajax request and the action registered with add_action('wp_ajax_....) doesn't match. Are you using the code I posted as it is or have you modified something? As I said in the answer, I didn't test the code.
    – cybmeta
    May 8, 2016 at 20:23
  • 1
    I modified it, but the function executed, because the session ended after that. But nvm, I just tried again and it worked that time, thank for your help! May 8, 2016 at 20:24
2

Is there something additional that wp_logout does?

As I said in my comment, WordPress runs two functions on wp_logout.

  1. wp_destroy_current_session()
  2. wp_clear_auth_cookie()

wp_clear_auth_cookie() removes all of the cookies associated with authentication. This is what you would like to do with JavaScript.

However there's also wp_destroy_current_session(). This function remove the current session token from the database which brings us to the next question..

Would be potential problems if I delete wordpress_logged_in_47d1523b... cookie using javascript?

No, there could not be any problems because users can manually delete sessions and cookies but that doesn't break the web. As long as you delete the right session, everything works as you planned.

Now you might be wondering: what about session token in database? That doesn't matter anymore because session is destroyed. It will be overwritten by new token as soon as user logs in again.


And now the bad news: How are you going to delete the session with only JavaScript? Session key and value are both generated, you have no way to target the right one only with JavaScript. Session key and value are different for every user and for every session.

1
  • The good news: Regular Expressions :P May 7, 2016 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.