Symfony2 how to invalidate all the session attributes

Question

In my Symfony2 project i have a logout button which redirect to the index page but when i click the Login button it connects directly without asking me for user and password.

how can i validate all session attributes, so if i login again it should ask me for user and password

this is my logout Action:

public function logoutAction(Request $request)
    {    
        $this->get('security.context')->setToken(null);
        $this->get('request')->getSession()->invalidate();

        $url = $this->generateUrl('my_route');
        $response = new RedirectResponse($url);
        $response->headers->clearCookie('PHPSESSID');
        $response->send();
        return $response;
    }   

here's the security.yml:

security:

    encoders:
        Envivio\UserBundle\Entity\User: sha512

    role_hierarchy:
        ROLE_USER:        ROLE_USER
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH ]

    providers:        
        mine:
            id: ib_user.oauth_user_provider

    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false        

        main:
            anonymous: true
            pattern: ^/
            oauth:
                resource_owners:
                    salesforce: "/login/check-salesforce"
                login_path:   /login
                #use_forward:  false
                failure_path: /login
                default_target_path: /upload
                oauth_user_provider:
                    service: ib_user.oauth_user_provider                
            remember_me:
                key:     "%secret%"


    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }       
        - { path: ^/admin, role: ROLE_ADMIN }

Answer 1

You can try :

$this->get('session')->clear();

or

$session = $this->get('session');
$ses_vars = $session->all();
foreach ($var as $key => $value) {
    $session->remove($key);
}

It may also be a cookie problem check your cookies in the response->headers then try clearing it with that function :

http://api.symfony.com/2.3/Symfony/Component/HttpFoundation/ResponseHeaderBag.html#method_clearCookie

Edit :

Since you have remember me enabledyou need to clear that cookie too otherwise the next request you do will reauthenticate the user, you can specify a name for the cookie :

  #security.yml
    
    remember_me:
             name: "%session.remember_me.name%"

add in parameters.yml the name of the cookie

parameters:
    session.remember_me.name: EXTSESS

then in your controller logout action :

$response = $this->redirectToRoute('homepageroute'); //redirect prepare the route to redirect
$this->get('security.context')->setToken(null);
$this->get('request')->getSession()->invalidate();
$remember_sess_name = $this->container->getParameter('session.remember_me.name');

$response->headers->clearCookie($remember_sess_name);

return $response;

it should work now. if this doesn't then ALT+F4 :D

Answer 2

You don't need to do it manually. The Symfony2 firewall can perform a logout like this:

# app/config/security.yml
security:
    firewalls:
        secured_area:
            # ...
            logout:
                path:   /logout
                target: /
    # ...

Next, you'll need to create a route for this URL (but not a controller):

# app/config/routing.yml
logout:
    path:   /logout

And that's it! By sending a user to /logout (or whatever you configure the path to be), Symfony will un-authenticate the current user.

Once the user has been logged out, they will be redirected to whatever path is defined by the target parameter above (e.g. the homepage).

Link to the related doc: http://symfony.com/doc/current/book/security.html#logout