Tips for cleanup code on logout?

[JohanR]

Hi,

Going through various bits of documentation and posts in the forum on cleaning up a session.

Somewhere it was mentioned that it was not a good idea to delete a session on logout.

I have created a procedure that clears the important values in the session queue, but I need to make sure that I make a note and that this is cleared on logout.

Is there a magic method that I can call that will clear all session values that have been added but keep the session queue live?


Or any other tips on a very secure and efficient cleanup method on logout.


thanks

Johan

[Bruce]

>> Somewhere it was mentioned that it was not a good idea to delete a session on logout.

It's more subtle than that. If you delete the session on logout then you must go to a "page" when they logout, not a form, and specifically not the login form.

[CaseyR]

Just to be certain.  My logout returns uses IndexPage?Logout_btn=yes,  but will call the login form page automatically because there is no longer an active session.  That is OK, right?  Thanks. 

[Bruce]

it's ok to do that - but in that case do not "delete session on logout". If you do then the form setup for the Login form will be lost at that point, rendering the login form ineffective.

Then again I'm not sure how your IndexPage is calling the login immediately - does your IndexPage have "login required" set?

If you want to delete the sesison on Logout, then it'd be better to just go to IndexPage (not requiring a login) and let the user click the "Login" menu item or button or whatever to initiate a login.

cheers
Bruce