Web Security · Junior · Question 51 of 75
What should happen to the session when the user logs out?
- 1The session is kept so that the next login is faster
- 2The browser deletes the cookie, and nothing else is needed
- ✓Correct answer: The server invalidates it, so the old session ID no longer works even if someone copied it
Explanation
Deleting the cookie on the client isn't enough: a stolen copy would still be valid. The server-side session must be destroyed.