How to prevent security risk when logout failed for authentication cookies

Question

In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected.

But it seems that there is a security risk in the situations described below:

situations:

1. I set an authentication cookie for logged users on the server.
2. the cookie marked as Http-only to prevent XSS attack.
3. the cookie set 3 months expiration to prevent inputting credentials every time.
4. Occasionally, the network is not working for some unknown reason when the user clicked the logout button so the browser keeps that cookie after the user logged out.
5. but the wiki told me that I do not have the permissions to change the Http-only cookies by javascript.

Then no matter what you have done, the server didn't revoke that authentication cookie and that cookie remains in the browser. Then there is a security risk.

Answer 1

Use a second cookie on top of the session cookie. When logging in, put some random data in that cookie and in the session. On every access, check whether these match. On logout, remove this cookie on the client side.

This second cookie is not HttpOnly, so you can remove it using JavaScript. To perform authenticated requests you need both cookies, and an XSS attack can't read the session cookie as its HttpOnly. So you get the advantages of HttpOnly while still being able to revoke the session on the client.