title: PHP session not invalidated after destroy / reset, stays alive
body: <p>i have found a strange issue on my server (php 5.4.0, apache) regarding session handling in php.</p>
  
  <p>i have a function that start the session which contains the following code and is called always before anything else in my application:</p>
  
  <pre><code>static function startSession()
  {
      $httponly = true;
      $secure = true;
  
      if (ini_set('session.use_only_cookies', 1) === FALSE) {
          exit();
      }
  
      session_name("my_session");
  
      $cookieParams = session_get_cookie_params();
  
      session_set_cookie_params(
          60*60,
          $cookieParams["path"],
          $cookieParams["domain"],
          $secure,
          $httponly
      );
  
      session_start();
  }
  </code></pre>
  
  <p>Then there is a login procedure which does something like that:</p>
  
  <pre><code>$_SESSION['key1] = 'some value';
  
  session_regenerate_id(true);
  </code></pre>
  
  <p>And finally there is a logout function:</p>
  
  <pre><code>static function logout()
  {
      $_SESSION = array();
  
      $params = session_get_cookie_params();
  
      setcookie(
          session_name(),
          '',
          time() - 42000,
          $params["path"],
          $params["domain"],
          $params["secure"],
          $params["httponly"]
      );
  
      return session_destroy();
  }
  </code></pre>
  
  <p>Now to the issue:
  When i login the following happens:</p>
  
  <pre><code>startSession();
  ...
  $_SESSION['key1'] = 'some_value';
  ...
  </code></pre>
  
  <p>Somehow in the future i call:</p>
  
  <pre><code>logout();
  </code></pre>
  
  <p>session_destroy(); returns true, $_SESSION is reset. everything fine.</p>
  
  <p>I then retest the request by sending the session cookie again to request some information and the session is again alive. All the information are sill there.</p>
  
  <p>On the server i can see a session file that is generated:</p>
  
  <p>sess_ : 394B</p>
  
  <p>i have the following session setup:</p>
  
  <pre><code>ini_set('session.hash_function', 'sha512');
  ini_set('session.entropy_file', '/dev/urandom');
  ini_set('session.entropy_length', 256);
  ini_set('session.use_trans_sid', 0);
  ini_set('session.use_only_cookies', 1);
  ini_set('session.cookie_lifetime', 0);
  ini_set('session.use_strict_mode', 1);
  ini_set('session.cache_limiter', 'nocache');
  </code></pre>
  
  <p>my session_save_path() is somewhere in /var/www/html/sites/....</p>
  
  <p>What am i missing or doing wrong?</p>
  
  <p>Thanks in advance</p>
  
  <p>Dennis</p>