WEB / CASE two-state-owners
Logout happened. Why does a cookie remain?
Separate the cookie jar from the server session store using rotation, expiry and logout evidence.
Observation file
Teaching alias sid-b remains in the browser jar. The synthetic store says revoked. A protected request establishes no authenticated context. The alias is not a credential; this file has no real secret.
Separate state owners
The presence of a cookie does not show server acceptance. Invalidation changes server state. Browser cleanup concerns receipt and application of an expiry response for the matching cookie scope. Observe both separately.
A remaining cookie after normal expiry or logout is not evidence of a security incident. The question is whether a revoked or expired session still authorizes a protected action. Do not extrapolate the result to other active sessions.
Correction and regression
Check store invalidation and browser cleanup separately. In a fixed fixture, confirm that expired aliases produce authentication-required. Renaming a cookie does not prove server rotation or revocation.
YOUR TURN
Work through this story.
Predict the outcome, find the evidence boundary, and explain it in your own words.
sid-b remains in the jar, the store says revoked, and the protected request establishes no authenticated context. How do you distinguish the two state owners?
Selected observations from the synthetic case file
- teaching alias
- sid-b
- browser cookie jar
- alias present
- server session store
- revoked
- protected request
- no authenticated context
- The server session remains active because the cookie remains.
- Browser cookie cleanup is complete because the store says revoked.
- Server invalidation is observed; browser cleanup is separate and not shown as complete.
Read the explained answer
Server invalidation is observed; browser cleanup is separate and not shown as complete. — The records show that a remaining cookie does not mean an accepted session. Store invalidation and browser cleanup for the correct scope are separate checks. sid-b is a teaching alias, not a credential.
Why would labeling the remaining cookie after logout as “protected access continues” produce a false conclusion?
- This alias is revoked and the request establishes no authentication; cookie presence is not access evidence.
- The visible sid-b name proves that a real session secret leaked.
- Renaming the cookie revokes all server sessions.
Read the explained answer
This alias is revoked and the request establishes no authentication; cookie presence is not access evidence. — Bound the finding by the protected-request result and server state. Incomplete cookie cleanup may deserve a separate check, but do not equate cookie persistence with successful authorization or a secret leak.
Write a regression plan that separates browser and store evidence for rotation, expiry and logout. What should you avoid assuming about other active sessions?
Read the explained answer
For rotation, compare rejection of the old alias by the store with acceptance of the new alias under its fixture conditions. For expiry, the expired alias produces authentication-required on a protected request. For logout, record store invalidation separately from application of a cookie expiry response for the matching scope. Do not transfer these outcomes to other active sessions. Record teaching aliases without logging real session secrets.
□ Does rotation compare old and new alias decisions separately?
□ Is the expiry result tied to the store’s time check?
□ Are logout invalidation and browser cleanup separated?
□ Are extrapolation to other sessions and real-secret logging avoided?
Lessons connected to this case · 7
Return to the case with these lesson concepts. Connections do not add observations to the case record; they help examine its responsibilities together.