Logging out is a server-side operation
Testing session termination, timeouts and reuse of an old token.
Document the lifecycle
A session starts at login, changes during privilege elevation and should end according to defined rules. Record expected behavior for logout, expiry and password changes. Different token types may have different revocation requirements.
Replay an authorized request
Using your own test account, save a request to a protected function. Log out and replay it with the old session identifier. Compare actual access with the agreed policy, rather than simply checking whether buttons have disappeared from the interface.
Distinguish caching from live access
The browser’s back button may display a saved page. This is different from being able to obtain fresh protected data from the server. Inspect the network request and separately assess whether sensitive content should remain in the cache.
Verify the fix
Retesting should cover the web interface, API and, where applicable, sessions on multiple devices. Clarify whether logout should terminate one session or all of them. Recommendations must fit the token architecture rather than stopping at cookie deletion.