SessionDestroyLeavesLocalAuthentication

warning native on by default

Group: Probable bugs

Destroying stored session data does not clear the current session array. Clear local authentication state before reading it again.

Example

<?php
session_destroy(); if($_SESSION["admin"]){echo "admin";}

Reported:

• line 2: Clear local session data after destroying the session.

Detection

• Resolved session_destroy precedes a read of $_SESSION in a condition in same scope, with no intervening $_SESSION=[]/unset or successful new session_start. Highlight post-destroy session read.
• The initial supported proof is an immediately preceding session_destroy and direct session array access as the if condition; guarded or nested conditions are excluded.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Do not report when the statement directly before session_destroy already removed the local value: a plain assignment of an empty array ([] or array()) to $_SESSION, a resolved builtin session_unset() call, unset($_SESSION), or an unset of the same literal key as the one read (string keys compare by value, so quote style is irrelevant; a string key never matches a numeric literal). Any other preceding statement, a non-literal key, a different key, a non-empty array, a compound or by-reference assignment keeps the report.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Configure

In custos.json:

{
  "rules": {
    "SessionDestroyLeavesLocalAuthentication": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SessionDestroyLeavesLocalAuthentication