Overview
Logging out should reliably end a session — but a surprising number of applications handle it poorly, leaving sessions usable after "logout." Correct logout is a real security control. This lesson covers logout and session termination.
Learning objectives
- Explain what proper logout must accomplish.
- Distinguish client-side from server-side session termination.
- Identify common logout weaknesses.
Core concept
Logout must invalidate the session so it can no longer be used. Crucially, this requires server-side invalidation — merely deleting the cookie in the browser is not enough if the session (or token) remains valid on the server. Proper logout:
- Invalidates the session server-side (destroys server-side session state, or revokes the token).
- Clears the session cookie in the browser.
- Ensures the old session identifier can no longer authenticate.
How it works
For server-side sessions, logout destroys the stored session so the ID becomes meaningless even if an attacker still has it. For token-based sessions, true invalidation is harder because tokens are self-contained — it typically requires a revocation list or short token lifetimes, since simply deleting the client's token does not stop a copy from being reused. A logout that only clears the browser cookie but leaves the session valid server-side is a broken logout: a stolen session survives the user's logout.
Practical example
A user logs out; the app destroys the server-side session and clears the cookie. If an attacker had previously stolen that session ID, it now fails — the server no longer recognizes it. Contrast a broken implementation that only tells the browser to forget the cookie: the underlying session stays valid, so a stolen copy of the ID still works after the user believes they have logged out. Proper server-side invalidation is what makes logout meaningful.
Cybersecurity relevance
Broken logout is a recognized session-management weakness: it undermines a user's ability to protect their account (e.g. on a shared computer) and leaves hijacked sessions alive. Related controls include session timeout/expiration (idle and absolute), and invalidating sessions on password change. Testers verify that a session is truly dead after logout (replaying the old identifier should fail); defenders ensure server-side invalidation, not just cookie clearing.
Common mistakes
- Only clearing the client cookie while leaving the session valid server-side.
- Not invalidating tokens in stateless setups (needs revocation or short lifetimes).
- Failing to invalidate sessions on password change, leaving old sessions active.
Key takeaways
- Logout must invalidate the session server-side, not just delete the browser cookie.
- Server-side sessions are destroyed on logout; token sessions need revocation lists or short lifetimes since deleting the client token is insufficient.
- Broken logout leaves stolen or shared sessions usable; verify the old identifier truly fails, and invalidate sessions on password change and via timeouts.
Check your understanding
- Why is deleting the session cookie in the browser insufficient for a secure logout?
- Why is fully invalidating a stateless token session harder than a server-side session, and what helps?