Yes I agree.

Working on this

488bc8b is the functionality for this. There are few issues though:

• "destroy" method would need to be added to the interface (so BC break)
• While docs for the "clear" method in interface defines itself as "Clear all session data in memory." NativeSessionStorage (and not only it) also calls loadSession() which reconnects bags back to the session), probably because right now handlers operate with the presumption that session always exists. I got around it by moving some of the functionality of it (that "destroy" reuses) to the new protected "clean" function, but I don't think that, logically, "loadSession" should be called in "clear" at all (which would be a BC break), or we can leave "clear" as it is now, and add "clean" to the interface, and update docblock comments.

Also, right now both "set" and "get" methods of session object will start up session. That seems to be logical for the "set", but probably behaviour should be changed for the "get" method.

+1, session needs a bunch of improvements. lets do the necessary BC breaks in symfony 3.0! (add to #11742?)

note that session_destroy does not remove the session cookie, only remove all data. but for caching, what we really need is to get rid even of the session cookie. maybe we could call the method remove() instead of destroy to avoid confusion.

and lets not mix this issue with the topic of fixing session behaviour to avoid accidental sessions. that is the topic of #6036 and there is #6388 which has been waiting for feedback for a long time.

i hope that #12325 can be pushed forward to clean up session handling in symfony in general.

btw, the workaround i currently use is $response->headers->clearCookie($request->getSession()->getName());

@dbu says it all, it's a real problem for caching.
If anyone is willing to write an RFC, I'd gladly write a PR :)
/cc @Tobion

What it means "write rfc"?

@andypost something like that : #12325

Oh, juste stumbled upon http://symfony.com/doc/current/reference/configuration/security.html#logout-configuration and the delete_cookies node which fits my use case.

@geoffrey-brier Do you finally use delete_cookies security logout option ? I can not make it work, or I need to inject if in a logout success handler...

@alterphp TBH I didn't implement something as only admin can log in, the impact was not that important.

But from what I remember, the delete_cookies would be too complicated to implement as I had a bunch of cookies and I figured that the easiest to do would be to manually clear ALL cookies in a logout success handler.

@geoffrey-brier Thanks. I use a logout success handler too, as I can't make delete_cookies options do the job.