<?php
/**
 * logout.php — PHP 8.4 compatible
 *
 * Changes from original:
 *  - session_unset() called before session_destroy() — proper cleanup order.
 *  - Cookie cleared manually (prevents stale session cookie in browser).
 *  - exit() added after header() redirect.
 *  - Removed the bare if(session_destroy()) wrapper — session_destroy()
 *    returns false only if no session was active; safe to call unconditionally.
 */

session_start(['gc_maxlifetime' => 14400, 'cookie_httponly' => true]);

// 1. Clear all session variables
session_unset();

// 2. Delete the session cookie from the browser
if (ini_get('session.use_cookies')) {
    $params = session_get_cookie_params();
    setcookie(
        session_name(),
        '',
        time() - 42000,
        $params['path'],
        $params['domain'],
        $params['secure'],
        $params['httponly']
    );
}

// 3. Destroy the session on the server
session_destroy();

header('Location: index.php');
exit();
