fix: clear all session entries in SessionStore::purge() regardless of key order

src/Store/SessionStore.php

@@ -9,6 +9,7 @@
 use Auth0\SDK\Utility\Toolkit;
 
 use function defined;
+use function is_string;
 
 /**
  * This class provides a layer to persist data using PHP Sessions.
@@ -96,16 +97,16 @@ public function purge(): void
     {
         $this->start();
 
-        $session = $_SESSION ?? [];
-        $prefix = $this->sessionPrefix . '_';
+        if (! isset($_SESSION)) {
+            return;
+        }
 
-        if ([] !== $session) {
-            while ($sessionKey = key($session)) {
-                if (mb_substr((string) $sessionKey, 0, mb_strlen($prefix)) === $prefix) {
-                    unset($_SESSION[$sessionKey]);
-                }
+        $prefix = $this->sessionPrefix . '_';
 
-                next($session);
+        // Snapshot keys first so a falsy key (0 or "") cannot terminate iteration early.
+        foreach (array_keys($_SESSION) as $sessionKey) {
+            if (is_string($sessionKey) && str_starts_with($sessionKey, $prefix)) {
+                unset($_SESSION[$sessionKey]);
             }
         }
     }

tests/Unit/Store/SessionStoreTest.php

@@ -13,6 +13,9 @@
         session_destroy();
     }
 
+    // session_destroy() leaves $_SESSION populated, so reset it to isolate tests.
+    $_SESSION = [];
+
     $this->configuration = new SdkConfiguration([
         'domain' => MockDomain::valid(),
         'clientId' => uniqid(),
@@ -75,6 +78,44 @@
     fn() => uniqid(),
 ]]);
 
+test('purge() clears values when a falsy key precedes them in the session', function(string $key, string $value): void {
+    // A falsy key positioned before the prefixed keys must not stop the purge early.
+    $_SESSION = ['' => 'falsy-string'] + $_SESSION;
+    $_SESSION[0] = 'falsy-int';
+    $_SESSION[$this->namespace . '_' . $key] = $value;
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeTrue();
+
+    $this->store->purge();
+
+    expect($this->store->get($key))->toBeNull();
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeFalse();
+
+    // Non-Auth0 entries must be left untouched.
+    expect($_SESSION[''])->toEqual('falsy-string');
+    expect($_SESSION[0])->toEqual('falsy-int');
+})->with(['mocked data' => [
+    fn() => uniqid(),
+    fn() => uniqid(),
+]]);
+
+test('purge() clears values when a falsy integer key precedes them in the session', function(string $key, string $value): void {
+    // The php_serialize handler leaves a leading integer key. It must not stop the purge early.
+    $_SESSION = [0 => 'falsy-int'];
+    $_SESSION[$this->namespace . '_' . $key] = $value;
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeTrue();
+
+    $this->store->purge();
+
+    expect($this->store->get($key))->toBeNull();
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeFalse();
+
+    // The non-Auth0 integer key must survive.
+    expect($_SESSION[0])->toEqual('falsy-int');
+})->with(['mocked data' => [
+    fn() => uniqid(),
+    fn() => uniqid(),
+]]);
+
 test('regenerate() preserves stored values', function(string $key, string $value): void {
     $this->store->set($key, $value);
     expect($this->store->get($key))->toEqual($value);