Incomplete Session Invalidation on Logout

[dkatzz]

Describe the bug
Session cookies are not being destroyed after a user logs out. This means that compromised session data could be misused, undermining the expected security benefits of the logout process.

This may be part of the work the team is already doing, but wanted to call out specifically

Recommendations

• The server must explicitly invalidate the associated session data and session cookie by deleting the session data from the server-side store and marking the cookie as expired
• Upon logout, create a completely new session ID for the user. This ensures that even if the old session cookie exists, it's no longer tied to valid session data.

[dkatzz]

If you log in and then look at the cookies in the network tab, when you log out, the session cookie doesn't get wiped

I think you can then log back in using the cookies (and without the login info), but I'm not exactly sure how