I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like
logout which will make the cookie my app is using be invalid from now on.
So I see that if a hacker intercepts that cookie, then a user logs out (which means for me - remove the cookie) and then the hacker is able to make calls to API despite the user thinking it's not possible anymore.
Can I do something else other than just remove the cookie?
Cookie has a timeout - 24h. This timeout is renewed every call to API.