In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected.

But it seems that there is a security risk in the situations described below:


  1. I set an authentication cookie for logged users on the server.
  2. the cookie marked as Http-only to prevent XSS attack.
  3. the cookie set 3 months expiration to prevent inputting credentials every time.
  4. Occasionally, the network is not working for some unknown reason when the user clicked the logout button so the browser keeps that cookie after the user logged out.
  5. but the wiki told me that I do not have the permissions to change the Http-only cookies by javascript.

Then no matter what you have done, the server didn't revoke that authentication cookie and that cookie remains in the browser. Then there is a security risk.

  • The whole purpose of the HttpOnly-flag is to make sure JavaScript can't interact with the cookie. They HttpOnly-flag is set by the server, and the client will send the cookie to the server with every request.
    – user163495
    Commented Aug 7, 2019 at 7:39
  • 2
    Perhaps it should be left up to the UI to communicate to the user whether they have been logged out or not? Commented Aug 7, 2019 at 22:02
  • So, maybe the best solution is two steps: first, we should found a way to clear the cookie just like Sjoerd's answer. second, we raise up a dialog to tell people what to do in the next when the network is not reachable. @multithr3at3d Commented Aug 8, 2019 at 2:37

1 Answer 1


Use a second cookie on top of the session cookie. When logging in, put some random data in that cookie and in the session. On every access, check whether these match. On logout, remove this cookie on the client side.

This second cookie is not HttpOnly, so you can remove it using JavaScript. To perform authenticated requests you need both cookies, and an XSS attack can't read the session cookie as its HttpOnly. So you get the advantages of HttpOnly while still being able to revoke the session on the client.

  • This may be the best solution. I am wondering if this is a standard way to handle this exception? Commented Aug 7, 2019 at 7:28
  • Using two cookies is not common, but not unheard of. Two cookies are useful for SameSite cookies, where one is Lax and the other is Strict. I have never seen it before to ensure logout, as in your case.
    – Sjoerd
    Commented Aug 7, 2019 at 7:35
  • I had checked youtube and stackoverflow. And I found most of the website can not logout when the network is unreachable. Commented Aug 7, 2019 at 8:39
  • But if someone has copied the cookie, logging out locally won't prevent them from using it elsewhere. Commented Aug 7, 2019 at 22:02
  • I think that should be the responsibility of the browser to prevent someone copes that cookie when that user is using the computer.@multithr3at3d Commented Aug 8, 2019 at 2:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .