I get constant reports of failure to sign-out from my Outlook account. I am wondering if this problem can compromise the account or generate a vulnerability (backdoor-path)?
Inability to log out means that user leaves an open-session to the account, and if attacker grabs a cookie (by syncing browser history) he can easily re-enter the account and hijack the associated session.
Closing the browser may partially help to prevent this type of attack. But, closing browser invalidates cookie only on user-end, not on server-end (email provider), which may still be Active. Also, 2FA is completely useless at this point, because the "entry" to the account already been authenticated by the user upon successful login (with, or without 2FA).
So, how do I know if a session to the account has expired if I can't logout from it? Could a failure to logout be a sign that someone else accessing my account?