How to Delete Session Cookie?

In web development, managing cookies is a common requirement, particularly for deleting session cookies. Session cookies are cookies that do not have an expiration time set; they only exist while the browser is open. Once the browser window is closed, session cookies are automatically deleted. However, in certain scenarios, it may be necessary to actively delete these cookies during the user's browser session, such as during a logout operation.

How to Delete Session Cookies

1. Setting Cookie Expiration via Server-Side Code: The server can instruct the browser to delete a specific cookie by sending a Set-Cookie header with a past date. For example, when using PHP in an HTTP response, you can do the following:

php
setcookie("sessionCookie", "", time() - 3600);  // Sets the cookie's expiration time to one hour ago

Here, "sessionCookie" is the name of the cookie to be deleted. time() - 3600 specifies a past time, instructing the browser to immediately remove this cookie.

1. Deleting via Client-Side JavaScript: On the client side, you can delete session cookies by setting a cookie with the same name and an expiration time set to a past date. For example:

javascript
document.cookie = "sessionCookie=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/";

This code creates a cookie with the same name as the existing sessionCookie, but with the expires attribute set to January 1, 1970 (the Unix timestamp origin), causing the browser to immediately delete it.

Operation Examples

Suppose we have a website where, after user login, the server sets a session cookie named userSession. When the user clicks the 'logout' button, we need to delete this cookie.

Backend (Node.js Express Example):

javascript
app.get('/logout', function (req, res) {
   res.cookie('userSession', '', { expires: new Date(0) });
   res.redirect('/login');  // Redirects the user to the login page
});

Frontend (JavaScript Example):

javascript
function logoutUser() {
   document.cookie = "userSession=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/";
   window.location.href = '/login';  // Redirects the user to the login page
}

Both methods effectively delete the user's session cookies, ensuring session information is not retained on the client side and thereby enhancing application security. In actual development, depending on whether you can control client-side or server-side code, choose the most appropriate method.