I have a PHP web application running on a Linux server. It is accessed via a browser.
It uses PHP sessions to store the user's login state and userid. I need to log out all users.
I have root access, and am attempting to destroy all the PHP sessions forcing all users to log in again.
I've deleted all the sess_XXX files stored in /tmp/ and when I return to the webapp I am still logged in, and the session file is recreated in /tmp/ and all my details are still intact - using the same values as previously suggesting the session data is still being stored somewhere.
There's no "caching mechanism" that I know of, other than the PHP session files caching the user's data.
I've tried altering the PHP session name and then deleting the session files, but I'm still logged in. Examining the sess_XXX files shows identical information even after the session file is deleted, and then recreated by visiting the application again in the web browser. This information is not stored in the users browser, so it must be being retrieved from the session.
Anyone know how can I really destroy the sessions and force users to log out?