Study. uk . com
  1. Home
  2. All questions
  3. Question 288

CompTIA Security+ study material · question 288 of 611

A logout function deletes the session cookie in the browser but leaves the server-side session valid. What is the risk?

  1. A previously captured identifier can still be presented successfully
  2. The session will be counted twice in concurrency limits
  3. The next login will reuse the same identifier
  4. The user cannot log in again until the session expires
Show the answer

Answer: A. A previously captured identifier can still be presented successfully

Logout must destroy the session server-side; clearing the client copy only affects the honest user's browser.

Source: OWASP Session Management Cheat Sheet (OWASP) — OWASP Session Management Cheat Sheet › Session Expiration

Challenge yourself on this topic → Study as cards