Setting a temporary cookie to an invalid value when logout improves security?

Question

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid.

I think that it could be useful to also set to a blank or invalid value the session cookie in the browser, even if it is a temporary cookie. For example, when you click the Logout button the server could answer with a Set-Cookie that sets an invalid value for the cookie.

Does this measure improve the security of the site or is this "too much" having into account that the cookie is temporary and the session is closed correctly in server-side?

Answer 1

Ultimately with a web application, the security should always reside at the server-side, and as such the important measure when a user is logged out of an application is to ensure that the session is no longer valid on the server-side.

I don't think that there's any harm in invalidating the session on the client-side as well, it might be useful to reduce load on the server as it doesn't need to do a look-up on the session ID to see if it's valid or perhaps to improve user experience in quickly routing a user to the login page.

However setting it on the client-side should not be considered a security measure.