I have implemented stateless session cookie, something along the lines of this article:
The cookie contain an expiry time within the hashed value, and also the cookie is set with a session timeout in the browser. When the user logs out, the cookie is deleted. However, someone noted that an attacker can steal the cookie and essentially use it within the specified expiry time in the cookie even though the user has logged out. Is there a solution to this problem (beside ditching stateless session cookie and using standard server/framework session management)?