As a beginner pentester, I was pentesting one of our applications and found that the cookies are not getting destroyed when a user log outs. The cookies did come with an expiration time and date.
What I checked:
Without logging in, I tried to access a URL that lies behind the login, but I sent that HTTP request with the cookie that I had noted down before logging out. I was able to access the page as if I am a logged in user. Later, I tried the same URL with the same cookie, but after the expiry time of the cookie and as expected, the URL threw a 403 forbidden error. Is this a normal practice? Or should I ask the app owners to destroy the cookie as soon as the user logs out regardless of cookie's expiry date?