Netflix
Session Termination on Logout
Currently the JWT Session Tokens are not being terminated when a user logs out. When a web application fails to invalidate the authentication token upon user logout, the session token remains active until its expiration. Unfortunately, in certain instances, this vulnerability allows old security tokens to be repurposed even after a user has officially logged out. This issue poses significant security risks, potentially granting unauthorized access to sensitive user accounts and compromising the overall integrity of the system.
When a user logs out, the session should be invalidated on the server-side. This ensures that any associated session tokens or JWT tokens become immediately unusable, enhancing security and preventing unauthorized access.
References:
The referenced issue was found via a pen test conducted in collaboration with Infor and Cobalt.io
