Failure to invalidate session on logout

Questions
1

So I am pentesting a few apps that okta for signing into the application. We have reported a finding called “failure to invalidate session on logout” stating that the session remain active on logging out from the browser.

Evidence:

  1. Capture one of the authenticated request using a proxy tool.
  2. Logout of the application from the browser.
  3. Go back to the proxy tool and try to replay the request.
  4. Observe that the request still works and we are able to see response that should be visible to the authenticated user only.

Is it something that comes by default in Okta that the session remains active on the backend even after logging out from the browser? Or this is something that can be fixed? Would be grateful if someone replies for this.

2

Do you have more information regarding the following?

  • What type of application is encountering this issue
  • How does the application currently handle logout?
  • Is this related to the Okta session remaining active OR the application’s own session remaining active 3
  • What request is being replayed that is succeeding even after the user logout?
3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.