Use both Session and cookie to keep security for the website
$_COOKIE[session_name()]
the session name is stored as cookie, other variables are stored as session var

auth.php

<?php
session_set_cookie_params(7200,’/’,”,true);
session_start();
if($_SESSION[‘auth’]!=’xxx’){
session_destroy();
header(“Location: ./login.php\n\n”);
exit;
}else{
//check fingerprint
$fp = $_SERVER[“HTTP_USER_AGENT”];
$fp .= $_SERVER[“REMOTE_ADDR”];

$fp = md5($fp);
if($_SESSION[‘par’] != $fp){
header(“Location: ./login.php\n\n”);
exit;
}
}
?>

login.php
check if ID, pass are matched with those in db….then

session_start();
$_SESSION[‘user_id’] = $uid;
$_SESSION[‘grp_id’] = $gid;
$_SESSION[‘auth’] = 1;

$fp = $_SERVER[“HTTP_USER_AGENT”];
$fp .= $_SERVER[“REMOTE_ADDR”];
$_SESSION[‘remote’] = md5($fp);
header(“Location: ./index.php”);

logout.php

session_set_cookie_params(7200,’/’,”,true);
session_start();
$_SESSION = array();
if(isset($_COOKIE[session_name()])){
$params = session_get_cookie_params();
setcookie(session_name(), ”, time()-3600,
$params[“path”], $params[“domain”],
$params[“secure”], $params[“httponly”]
);
}
session_destroy();
header(“Location: ./login.php\n\n”);
exit;

session_destroy() destroy the session, and cookie will be deleted as setting the cookie lifetime as a time past