After thoroughly investigating the problem, we found that by indicating a route in the creation ('/') the cookie was created on a higher domain with a prefix point ".", so when receiving the order to erase the the cookie for the full domain Edge deleted it but Chrome did not, because it did not match exactly.
We made the following modifications so that everything worked correctly:
Creating cookies
setcookie(
'marca_aleatoria_usuario_dw',
$numero_aleatorio,
time() + (60 * 60 * 24 * 365),
'/',
$_SERVER['HTTP_HOST']
);
setcookie(
'idusuario',
$iduser,
time() + (60 * 60 * 24 * 365),
'/',
$_SERVER['HTTP_HOST']
);
They are created with a duration of one year, with the options to configure the '/' directory of the website and for the domain that contains the server.
Deleting cookies
setcookie(
'marca_aleatoria_usuario_dw',
'',
time() - 3600,
'/',
$_SERVER['HTTP_HOST']
);
setcookie(
'idusuario',
'',
time() - 3600,
'/',
$_SERVER['HTTP_HOST']
);
As now exactly match the cookie creation data with the deletion data, the browser does not have the possibility of being mistaken for a cookie when deleting it or deciding not to do it because no field coincides.
Initial response
The superglobal variable $_COOKIES does not create or destroy cookies in the browser. Its content is generated during the start of the execution of the script with the content of the cookies sent to the server by the browser ( more information ).
That is, neither of these two lines works:
/* Esto no crea una cookie llamada "nueva_cookie" */
$_COOKIE['nueva_cookie'] = 'NUEVA COOKIE';
/* Esto no borra una cookie llamada "vieja_cookie" */
unset($_COOKIE['vieja_cookie'];
Instead you should use the setcookie() function in the following way:
/* Esto SÍ crea una cookie llamada "nueva_cookie" */
setcookie('nueva_cookie', 'NUEVA COOKIE');
/* Esto SÍ provoca el borrado de la cookie "vieja_cookie" */
setcookie('vieja_cookie', '', time() - 3600);
/* Sólo por cortesía y para que el resto del script tenga conocimiento
de la nueva cookie "nueva_cookie" y del borardo de "vieja_cookie" */
$_SESSION['nueva_cookie'] = 'NUEVA COOKIE';
unset($_SESSION['vieja_cookie']);
The third parameter indicates when the cookie should expire (by default it lasts until the browser closes). If we indicate a date in the past it will cause it to be deleted from the browser.
In practice the server generates a HTTP header Set-Cookie: vieja_cookie=deleted; ...; ; Max-Age=-3600 to create a new cookie "vieja_cookie" with a value "deleted" and, in addition, with a maximum negative age that causes it to be immediately discarded (deleted).
To end the sessions managed by PHP (assuming a session already started with session_start() ) you need to do the following:
// Si se desea destruir la sesión completamente, borre también la cookie de sesión.
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
$params["path"], $params["domain"],
$params["secure"], $params["httponly"]
);
}
/* Borramos los datos de sesión (pero no su archivo asociado) */
unset($_SESSION);
// Finalmente, destruir la sesión.
session_destroy();