session()->stop() not destroying data

destroy() are an alias for session_destroy.

stop() implements the functionality that the above function lacks unset the session cookie.
It's setting a new cookie and calling session_regenerate_id(true). session_regenerate_id with true are calling session_destroy. So the circle closes.

You call destroy() to log people out, but if you want the user to have a no knowledge of the previous session id you can force them a new cookie with stop().

You can see a more in depth description about it here. https://stackoverflow.com/questions/1826...3#18266353