Is there any sort of officially defined procedure (Eg from IETF) on how to correctly unset a cookie?
I've always considered it best practice to unset any session cookies at logout for a web application. I do this by setting the "session" cookie to a blank value, with an expiration date in the past, and the secure flag set to false. My thought is that "If by some trickery there were an unsecured session cookie, it will also be unset".
Is this a good practice?
The difficulty here is that the client is responsible for clearing the cookie value (whether it holds a session token or not) - from the server end, all you can do is hope that the cookie is cleared as you've requested. That's not really strongly definable - by definition, non-compliant clients wouldn't obey, so would keep the session token around.
The solution, therefore, is to unset the cookie value by whatever means you might consider valid (set it to expire in the past, empty it, set a dummy session cookie, or whatever), and expire the session token on the server side.
You control whether the server treats the session cookie provided as a valid token, so should ensure that it doesn't - at that point, it doesn't matter what the client does, and you can even pick up on "invalid" session tokens being provided as an indication that something has gone wrong - either the user has been changing the session value, the client hasn't deleted properly, or it's an attempt to use an old session (perhaps the computer was hibernated with the site open, and your session timeout has occurred).
Found an answer to the first part of my question that I thought I'd share here.
RFC 6265 (Page 8) states that:
Finally, to remove a cookie, the server returns a Set-Cookie header with an expiration date in the past. The server will be successful in removing the cookie only if the Path and the Domain attribute in the Set-Cookie header match the values used when the cookie was created.
