In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected.
But it seems that there is a security risk in the situations described below:
- I set an authentication cookie for logged users on the server.
- the cookie marked as Http-only to prevent XSS attack.
- the cookie set 3 months expiration to prevent inputting credentials every time.
- Occasionally, the network is not working for some unknown reason when the user clicked the logout button so the browser keeps that cookie after the user logged out.
Then no matter what you have done, the server didn't revoke that authentication cookie and that cookie remains in the browser. Then there is a security risk.