Home / Knowledge hub / Logout invalidation
Knowledge hub
Logout invalidation
Making sure signing out really kills the session on the server, not just in the browser.
What it means
Logout invalidation is the server destroying a session when a user signs out, so the old session id or token stops working everywhere. Clearing the cookie in the browser is not the same. That only hides the id from the user; it still works for anyone who copied it.
A real sign-out has two halves: the browser forgets, and the server refuses. If only the first happens, the user has pressed a button that does less than it claims, and a stolen session token keeps its value.
Why it matters
People sign out on shared computers and after suspicious activity because they believe it ends access. If a copied session id or token still works afterwards, a stolen cookie keeps its value after the owner does everything right. That is a failure users cannot detect.
It is also what audit reviewers test first. CWE-613, insufficient session expiration, covers sessions that remain valid after they should have ended, and a sign-out that changes nothing on the server fits it.
How it shows up
You meet it in server-side session stores, where logout deletes the record, and in token systems, where the server must track revoked tokens or keep them very short. Stateless JWTs are the common trouble spot, because nothing on the server says they are finished.
The mistakes repeat. A logout that only clears a cookie. Single sign-on that ends the app session but not the identity provider's. Refresh tokens that survive. Other devices left signed in after a password change. Replay a captured cookie after logout; it should be refused.
Questions people ask
Logout invalidation, answered
Is deleting the cookie enough?
No. The browser loses the cookie, but a copy held elsewhere is still accepted unless the server also ends the session.
Always remove or flag the session on the server.
How do we sign users out when we use JWTs?
Keep access tokens short and maintain a server-side list of revoked ones or revoked sessions. See token revocation.
Also revoke refresh tokens, since those are what mint new ones.
Should a password change sign out other devices?
Usually yes. If an account was taken over, the owner changing the password should end the attacker's session too.
OWASP session guidance lists this as a good practice.
What is the difference between logout and timeout?
Logout is the user ending a session on purpose. A timeout is the server ending it after inactivity or a maximum age.
Both must invalidate on the server.
How would a pentest check logout?
Capture a session cookie or token, sign out, then reuse the captured value against a protected page or API call.
If the request succeeds, the report shows it, with the request and the response.
Sources
Where this comes from
Related
Terms that sit next to this one
Session management
How your app creates, tracks, renews and ends a signed-in visit.
Session timeout
The point at which an idle or old session stops working and sign-in is required again.
Token revocation
Cancelling a token before it expires, for example after a password change.
Session hijacking
Stealing the token that tells your application a browser is logged in.
JWT
A signed token a client carries to prove who is signed in.
Does signing out change anything?
Sessions and tokens that keep working after logout or a password change are things we try on the running app, and a finding shows the replayed request. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.