security update

api/logout.php

@@ -1,5 +1,18 @@
 <?php
-session_start();
+header('Content-Type: application/json; charset=utf-8');
+require_once '../config/session.php';
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    echo json_encode(['success' => false, 'message' => 'Метод не поддерживается']);
+    exit;
+}
+
+$_SESSION = [];
+if (ini_get('session.use_cookies')) {
+    $params = session_get_cookie_params();
+    setcookie(session_name(), '', time() - 42000, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
+}
 session_destroy();
 echo json_encode(['success' => true]);
 ?>