fix: clear all session entries in SessionStore::purge() regardless of key order (#851)

### Changes

`SessionStore::purge()` walked `$_SESSION` with `while ($sessionKey =
key($session))` and advanced with `next()`. That loop condition is also
falsy when a session key is `0` or `""`, so if such a key appeared
before the SDK's own prefixed entries, iteration stopped early and left
the remaining `auth0_*` entries in the session. Because
`Auth0::logout()` clears state through `purge()`, the leftover entries
could persist after logout when the surrounding application had written
a falsy-keyed value to `$_SESSION`.

**🐛 Bug Fix:**

- `SessionStore::purge()` now iterates a snapshot of the session keys
via `array_keys()` instead of the `key()`/`next()` cursor, so a falsy
key can no longer terminate the loop early and every prefixed entry is
removed
- The prefix check uses `str_starts_with()` guarded by `is_string()`. On
v9 the previous loop already cast the key with `mb_substr((string)
$sessionKey, ...)`, so the `is_string()` guard here is hardening. The
uncast `mb_substr()` path only exists on `8.x`, where dropping it is a
genuine `TypeError` fix, so the `8.x` backport is where that matters
- `purge()` stays read-only and no longer touches `$_SESSION` when it is
unset, matching the prior behavior

### References

N/A

### Testing

- Added `purge() clears values when a falsy key precedes them in the
session`, which seeds an empty-string and an integer `0` key before the
prefixed entry and asserts the prefixed entry is removed while the
non-Auth0 entries survive
- Added `purge() clears values when a falsy integer key precedes them in
the session`, covering the `php_serialize` leading-integer-key case with
no empty-string key present
- Reset `$_SESSION` in `beforeEach` so the seeded falsy keys do not leak
into other tests under randomized ordering

- [x] This change adds unit test coverage
- [x] This change has been tested on the latest version of the
platform/language

### Contributor Checklist

- [x] I have read the [Auth0 general contribution
guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [x] I have read the [Auth0 code of
conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)

Author: kishore7snehil

src/Store/SessionStore.php

@@ -9,6 +9,7 @@
 use Auth0\SDK\Utility\Toolkit;
 
 use function defined;
+use function is_string;
 
 /**
  * This class provides a layer to persist data using PHP Sessions.
@@ -96,16 +97,16 @@ public function purge(): void
     {
         $this->start();
 
-        $session = $_SESSION ?? [];
-        $prefix = $this->sessionPrefix . '_';
+        if (! isset($_SESSION)) {
+            return;
+        }
 
-        if ([] !== $session) {
-            while ($sessionKey = key($session)) {
-                if (mb_substr((string) $sessionKey, 0, mb_strlen($prefix)) === $prefix) {
-                    unset($_SESSION[$sessionKey]);
-                }
+        $prefix = $this->sessionPrefix . '_';
 
-                next($session);
+        // Snapshot keys first so a falsy key (0 or "") cannot terminate iteration early.
+        foreach (array_keys($_SESSION) as $sessionKey) {
+            if (is_string($sessionKey) && str_starts_with($sessionKey, $prefix)) {
+                unset($_SESSION[$sessionKey]);
             }
         }
     }

tests/Unit/Store/SessionStoreTest.php

@@ -13,6 +13,9 @@
         session_destroy();
     }
 
+    // session_destroy() leaves $_SESSION populated, so reset it to isolate tests.
+    $_SESSION = [];
+
     $this->configuration = new SdkConfiguration([
         'domain' => MockDomain::valid(),
         'clientId' => uniqid(),
@@ -75,6 +78,44 @@
     fn() => uniqid(),
 ]]);
 
+test('purge() clears values when a falsy key precedes them in the session', function(string $key, string $value): void {
+    // A falsy key positioned before the prefixed keys must not stop the purge early.
+    $_SESSION = ['' => 'falsy-string'] + $_SESSION;
+    $_SESSION[0] = 'falsy-int';
+    $_SESSION[$this->namespace . '_' . $key] = $value;
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeTrue();
+
+    $this->store->purge();
+
+    expect($this->store->get($key))->toBeNull();
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeFalse();
+
+    // Non-Auth0 entries must be left untouched.
+    expect($_SESSION[''])->toEqual('falsy-string');
+    expect($_SESSION[0])->toEqual('falsy-int');
+})->with(['mocked data' => [
+    fn() => uniqid(),
+    fn() => uniqid(),
+]]);
+
+test('purge() clears values when a falsy integer key precedes them in the session', function(string $key, string $value): void {
+    // The php_serialize handler leaves a leading integer key. It must not stop the purge early.
+    $_SESSION = [0 => 'falsy-int'];
+    $_SESSION[$this->namespace . '_' . $key] = $value;
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeTrue();
+
+    $this->store->purge();
+
+    expect($this->store->get($key))->toBeNull();
+    expect(isset($_SESSION[$this->namespace . '_' . $key]))->toBeFalse();
+
+    // The non-Auth0 integer key must survive.
+    expect($_SESSION[0])->toEqual('falsy-int');
+})->with(['mocked data' => [
+    fn() => uniqid(),
+    fn() => uniqid(),
+]]);
+
 test('regenerate() preserves stored values', function(string $key, string $value): void {
     $this->store->set($key, $value);
     expect($this->store->get($key))->toEqual($value);