Direct answer
Logging out should end the intended session according to the product's policy. Verify the server's treatment of the prior credential, not just whether the browser navigates to a login page.
Define the promised scope
Ask whether logout affects the current browser, all sessions, an identity-provider session or only a local application session. Use a dedicated account and identify the affected cookie or access token without saving it in the report.
Reference: OWASP Session Management Cheat Sheet.
Capture the before and after
Confirm a protected harmless request succeeds before logout. Log out through the normal interface, then repeat that request with the earlier test credential from a controlled client. Check the response and protected content; a redirect alone may not show whether an API still accepts the credential.
- Protect the test credential and delete it after the assessment.
- Test both a web route and API route where in scope.
- Record the expected logout policy and observation time.
Review multiple sessions
Use a second test browser to check whether it remains signed in when the documented action is current-session logout, or is invalidated if the user selected sign-out everywhere. Distinguish identity provider logout from application session termination.
Account for token architecture
A short-lived signed access token may remain usable until expiry unless a server-side revocation mechanism is used. Compare actual behavior with the documented policy and risk, review refresh-token handling, then retest after the approved change.
Assessment limits
A single test does not prove all sessions or downstream services are invalidated. Federated identity providers and cached tokens may have distinct logout semantics and propagation delays.
Frequently asked questions
Does deleting a browser cookie invalidate the server session?
Not necessarily. A copied credential may remain accepted unless the server or relevant token system rejects it.
Must logout always end every device session?
That depends on the documented action. Test current-session logout and any separate sign-out-everywhere feature against their stated behavior.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.