title: phpmyadmin sso doesn't remove existing session in logout
body: <p>I'm trying to use PHPMyAdmin SSO in my custom application, made in Yii framework. Following phpMyAdmin guide I've made the needed changes in config.inc.php</p>
  
  <pre><code>$cfg['Servers'][$i]['auth_type'] = 'signon';
  $cfg['Servers'][$i]['SignonSession'] = 'MYSESSID';
  $cfg['Servers'][$i]['SignonURL'] = 'http://myapp.com/site/login';
  $cfg['Servers'][$i]['LogoutURL'] = 'http://myapp.com/site/logout';
  </code></pre>
  
  <p>PHPMyAdmin is linked to <a href="http://myapp.com/phpmyadmin/" rel="nofollow">http://myapp.com/phpmyadmin/</a> and in my application when someone logins I set the <em>PMA_single_signon_user</em> and <em>PMA_single_signon_password</em> with the username and password values. In the logout action I destroy the session (Yii::app()->session->destroy() equivelant to session_unset();session_destroy()). </p>
  
  <p>When a user logs into the application successfully he can click the phpmyadmin link and he'll be redirected successfully to the phpmyadmin interface. </p>
  
  <p>When a user logsout of the application, doesn't close the browser and logs in again my phpmyadmin link is redirecting to the login (SignonURL), even though the user was successfully logged in. </p>
  
  <p>Using firebug and some var_dumps in phpmyadmin/libraries/plugins/auth/AuthenticationSignon.class.php I've noticed that after a logout phpmyadmin still uses a MYSESSID under path /phpmyadmin/ which has the previous session's value. </p>
  
  <p>For example, I login to the myapp.com/site/login and I get </p>
  
  <pre><code>MYSESSID="value1" path=/ 
  </code></pre>
  
  <p>and i successfully click the myapp.com/phpmyadmin/ link. Now I have two MYSESSID in the br</p>
  
  <pre><code>MYSESSID="value1" path=/ 
  MYSESSID="value1" path=/phpmyadmin/
  </code></pre>
  
  <p>I logout (not closing the browser window) and login again, getting a new value in MYSESSID like:</p>
  
  <pre><code>MYSESSID="value2" path=/ 
  </code></pre>
  
  <p>I click the myapp.com/phpmyadmin/ link (I exit before the redirection to SingonURL) and see these sessions:</p>
  
  <pre><code>MYSESSID="value2" path=/ 
  MYSESSID="value1" path=/phpmyadmin/
  </code></pre>
  
  <p>From the AuthenticationSignon.class.php I understand that since phpmyadmin searches inside MYSESSID="value1" it can't find the needed <em>PMA_single_signon_user</em> and <em>PMA_single_signon_password</em>
  since I placed them under MYSESSID="value2". </p>
  
  <p>Bottom line of what I've understood is that when i destroy the session during the logout the session defined under path=/phpmyadmin/ is not being removed. </p>
  
  <p>anyone has any idea on how to properly logout or remove the session under path=/phpmyadmin/ ? </p>
  
  <p>When I close the browser window the MysESSID="value1" is completely removed for both paths / and /phpmyadmin/ so the re-login works fine. </p>
  
  <p>Note: I use only myapp.com and no www.myapp.com at all</p>