Not destroying cookies at log out

Question

As a beginner pentester, I was pentesting one of our applications and found that the cookies are not getting destroyed when a user log outs. The cookies did come with an expiration time and date.

What I checked:

Without logging in, I tried to access a URL that lies behind the login, but I sent that HTTP request with the cookie that I had noted down before logging out. I was able to access the page as if I am a logged in user. Later, I tried the same URL with the same cookie, but after the expiry time of the cookie and as expected, the URL threw a 403 forbidden error. Is this a normal practice? Or should I ask the app owners to destroy the cookie as soon as the user logs out regardless of cookie's expiry date?

Answer 1

A session has presence both on the client and on the server:

• On the client, the session identifier is stored in a cookie with a limited lifespan.
• On the server, the session is stored somewhere and typically also has an expiration date.

Logout functionality needs to handle both: remove the cookie from the client and terminate the session on the server. The latter is most important, or else the session remains valid even though the client no longer has the cookie. This seems not to happen in your case. Ask the developers to terminate the session on the server when a user logs out.

Without logging in, I tried to access a URL that lies behind the login, but I sent that HTTP request with the cookie that I had noted down before logging out.

So you logged out and could still access a page for which you should be authenticated. This means that on logout the session is not terminated, which it should.

Later, I tried the same URL with the same cookie, but after the expiry time of the cookie and as expected, the URL threw a 403 forbidden error.

This means that the session has expired on the server. The sessions on the server have a limited lifetime, which is good. This could be the same duration as the cookie expiration time, but it doesn't have to be.

Or should I ask the app owners to destroy the cookie as soon as the user logs out regardless of cookie's expiry date?

Yes, this is reasonable to ask.