I’m currently thinking about what happens when I log out of a website, and how that applies to Community Auth. Right now, when logging out, only the authentication related data is destroyed. Would it be “normal” to destroy the entire session? Should it be a configuration option to be able to choose how this is handled? I’m leaning on making it a configuration option so website owners can choose how logout is handled.
For instance, if I have an eCommerce site and I have a cart full of items, and am logged in to the website, when I log out, should the shopping cart data also be destroyed?
On the other side, if the cookie can be destroyed and the session no longer needs to be maintained, then the cookie can be totally removed.
I’m just going through this thing where I don’t want to have session cookies in use if there is no reason to have them. Why have a cookie if there’s no reason to have it?
Maybe when unsetting the authentication data, if no other userdata exists, then destroy the entire cookie? What do you think?