Logout does not work when using cookie prefixes

[lflobbe]

When renaming the WordPress cookies to use the __Host- or __Secure- cookie prefix, logging out no longer works. The wp_clear_auth_cookie() function needs to use the "Secure" cookie flag to ensure that modern browsers will allow in to overwrite the login cookies when cookie prefixes are used.

How to reproduce:

1. Use HTTPS
2. Set cookie prefixes in wp_config.php:

   if (@$_SERVER['HTTPS'] == 'on') { define( 'COOKIEHASH', md5( WP_HOME ) ); define( 'USER_COOKIE', '__Host-wpse_user_' . COOKIEHASH ); define( 'PASS_COOKIE', '__Host-wpse_pass_' . COOKIEHASH ); define( 'AUTH_COOKIE', '__Host-wpse_' . COOKIEHASH ); define( 'SECURE_AUTH_COOKIE', '__Host-wpse_sec_' . COOKIEHASH ); define( 'LOGGED_IN_COOKIE', '__Host-wpse_logged_in_' . COOKIEHASH ); define( 'TEST_COOKIE', '__Host-wpse_test_cookie' ); // __HOST- cookies MUST have their path set to / otherwise they will be ignored by the browser define( 'COOKIEPATH', '/' ); define( 'SITECOOKIEPATH', '/' ); define( 'ADMIN_COOKIE_PATH', '/' ); define( 'PLUGINS_COOKIE_PATH', '/' ); } 

3. Login
4. Try to logout. Inspect the cookies. Notice how the login cookies still have their original content and have not been overwritten.

Solution:
wp_clear_auth_cookie() needs to use the "Secure" cookie flag under all the same circumstances in which wp_set_auth_cookie() uses the "Secure" cookie flag.