1

Would be potential problems if I delete wordpress_logged_in_47d1523b... cookie using javascript? Is there something additional that wp_logout does?

  • It runs two functions: wp_destroy_current_session() and wp_clear_auth_cookie(). User cannot access restricted content, admin area and all that good stuff without a session. That still doesn't mean that you should mess with security features without any good reasons. What's your goal? – N00b May 7 '16 at 5:01
  • I want to logout users without making them go to wp-logout using js – IAmJulianAcosta May 7 '16 at 5:03
1

You can log out the current user with wp_logout() function:

I think it is much better approach. wp_logout() destroys current session, clears authorization cookie and call wp_logout action. Also, it is a pluggable function, which means can be redefined by plugins. You can miss important stuff, specially when working in combination with other plugins.

If you want to log out from JavaScript, you can execute wp_logout() using ajax (code not tested, just writted here as basic example):

add_action( 'wp_enqueue_scripts', 'cyb_enqueue_scripts' );
function cyb_enqueue_scripts() 
    wp_enqueue_script( 'cyb-ajax-logout', 'url_to_js_script', array( 'jquery' ) );
    wp_localize_script( 'cyb-ajax-logout', 'ajax_logout_params',
        array(
            'ajax_url'     => admin_url( 'admin-ajax.php' ),
            'logout_nonce' => wp_create_nonce( 'cyb-logout-nonce' ),
        )
    );
}

add_action('wp_ajax_cyb_logout', 'cyb_ajax_logout');
function cyb_ajax_logout(){
    if( check_ajax_referer( 'cyb-logout-nonce', 'logout_nonce', false ) ) {
        wp_logout();
        $reponse = array(
            'message' => __( 'You have been logged out.', 'cyb-textdomain' )
        );
        wp_send_json_success( $reponse );
    } else {
        // Ajax referer is wrong
        $reponse = array(
            'message' => __( "Unknown referer. You couldn't been logged out.", 'cyb-textdomain' )
        );
        wp_send_json_error( $reponse );
    }
}

And the js:

jQuery(document).ready(function($){
    var data = {
        action: 'cyb_logout',
        logout_nonce: ajax_logout_params.logout_nonce
    };
    $.getJSON( ajax_logout_params.ajax_url, data, function( response ) {
        if( response.success ) {
            // User has been logged out
        }
    });
});
  • I was driving home thinking about how could I logout using ajax and you gave me the answer without asking it :D – IAmJulianAcosta May 7 '16 at 16:57
  • Glad to help. If this answers your question, please consider to mark it as accepted answer so other users can find it easily. – cybmeta May 8 '16 at 18:36
  • Does wp_logout calls wp_die ()? Is logging out the user but returning 0. Weird – IAmJulianAcosta May 8 '16 at 20:01
  • wp_logout() returns nothing and it doesn't call wp_die(). The 0 you get is from wp_ajax_{my_action} action. If it returns 0, it is not working, very probably because the action parameter sent in the ajax request and the action registered with add_action('wp_ajax_....) doesn't match. Are you using the code I posted as it is or have you modified something? As I said in the answer, I didn't test the code. – cybmeta May 8 '16 at 20:23
  • 1
    I modified it, but the function executed, because the session ended after that. But nvm, I just tried again and it worked that time, thank for your help! – IAmJulianAcosta May 8 '16 at 20:24
2

Is there something additional that wp_logout does?

As I said in my comment, WordPress runs two functions on wp_logout.

  1. wp_destroy_current_session()
  2. wp_clear_auth_cookie()

wp_clear_auth_cookie() removes all of the cookies associated with authentication. This is what you would like to do with JavaScript.

However there's also wp_destroy_current_session(). This function remove the current session token from the database which brings us to the next question..

Would be potential problems if I delete wordpress_logged_in_47d1523b... cookie using javascript?

No, there could not be any problems because users can manually delete sessions and cookies but that doesn't break the web. As long as you delete the right session, everything works as you planned.

Now you might be wondering: what about session token in database? That doesn't matter anymore because session is destroyed. It will be overwritten by new token as soon as user logs in again.


And now the bad news: How are you going to delete the session with only JavaScript? Session key and value are both generated, you have no way to target the right one only with JavaScript. Session key and value are different for every user and for every session.

  • The good news: Regular Expressions :P – IAmJulianAcosta May 7 '16 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.