Failure to invalidate Session from the Server Side

The application fails to invalidate the session cookie from the server side when the user clicks on log out button. The application allows an attacker to reuse an old session cookie for accessing the application functionalities. Lack of proper expiration may increase the likelihood of success of certain attacks. Longer the expiration time, more concurrent open sessions will exist at any given time. Moreover, larger the pool of open sessions, more likely it will be for an attacker to guess one randomly.