How to log user in and out in slim rest framework using slim session middleware?
<p>I am using Slim framework to build a REST API and this is a rough application that I am using for development purposes. I want to log user in and out , and I set the session variable to the user id. The user is able to login perfectly fine in rest API but the remote device doesnt recognize the session (which means my $SESSION['id'] is empty) where as I clearly started this session in my host rest service. Here is my code:</p>

<pre><code>require 'lib/Slim/Slim.php';
use lib\Slim\Middleware\SessionCookie;

\Slim\Slim::registerAutoloader();

$app = new \Slim\Slim(
    array(
'cookies.encrypt' =&gt; true,
    'cookies.secret_key' =&gt; 'my_secret_key',
    'cookies.cipher' =&gt; MCRYPT_RIJNDAEL_256,
    'cookies.cipher_mode' =&gt; MCRYPT_MODE_CBC
        )
);

$app-&gt;add(new \Slim\Middleware\SessionCookie(array(
    'expires' =&gt; '20 minutes',
    'path' =&gt; '/',
    'domain' =&gt; '',
    'secure' =&gt; false,
    'httponly' =&gt; false,
    'name' =&gt; 'slim_session',
    'secret' =&gt; '',
    'cipher' =&gt; MCRYPT_RIJNDAEL_256,
    'cipher_mode' =&gt; MCRYPT_MODE_CBC
)));

$app-&gt;get("/login/:string", function($string) use ($app)
        {
            $input = json_decode($string);
            try 
            {
                if ($input-&gt;username &amp;&amp; $input-&gt;password) 
                    {
                        $user = Model::factory('Users')-&gt;where("username",$input-&gt;username)-&gt;where("password",md5($input-&gt;password))-&gt;find_one();
                        //$app-&gt;setCookie('user_id',$user-&gt;id);
                            session_cache_limiter(false);
                            session_start();
                       $_SESSION['id'] =  $user-&gt;id;

                        $status = 'success';
                        $message = 'Logged in successfully.';
                    } 
                else
                        {
                            $status = false;
                            $message = 'Could not log you in. Please try again.';
                        }

            }
            catch (Exception $e) 
                    {
                        $status = 'danger';
                        $message = $e-&gt;getMessage();
                    }
            $response = array(
                'status' =&gt; $status,
                'message' =&gt; $message
            );
            $app-&gt;response()-&gt;header("Content-Type", "application/json");
            echo json_encode($response);

        });



        $app-&gt;get("/logout",function() use ($app)
        {


            try {
                        unset($_SESSION['id']);
                        session_destroy();
                        session_start();

                        //$app-&gt;getCookie('user_id');

                        $status = 'success';
                        $message = 'You have been logged out successfully';
                    } 

            catch (Exception $e) 
                    {
                        $status = 'danger';
                        $message = $e-&gt;getMessage();
                    }
            $response = array(
                'status' =&gt; $status,
                'message' =&gt; $message
            );

            $app-&gt;response()-&gt;header("Content-Type", "application/json");
            echo json_encode($response);

        });
</code></pre>

<p>It is returning 'Logged in successfully' but isn't actually logging me in so in my application when I check <code>isset($_SESSION['id'])</code>  , there is nothing in the variable. Does anyone know whats going on? I am really confused  because according to the slim documentation , it says : </p>

<blockquote>
  <blockquote>
    <p>The session cookie middleware will work seamlessly with the $_SESSION superglobal so you can easily migrate to this session
    storage middleware with zero changes to your application code.</p>
  </blockquote>
  
  <p>If you use the session cookie middleware, you DO NOT need to start a
  native PHP session. The $_SESSION superglobal will still be available,
  and it will be persisted into an HTTP cookie via the middleware layer
  rather than with PHP’s native session management.</p>
</blockquote>