Cookie Security and Logout Testing

What Is Broken and Why

Session cookies are the primary authentication artifact in web applications. Missing security attributes expose them to theft via network interception (Secure absent), JavaScript injection attacks (HttpOnly absent), cross-site request forgery (SameSite absent), and cross-subdomain theft (Domain too broad). Cookies that persist beyond the session or survive logout allow session restoration attacks. In SSO environments, application-level logout without central-portal logout leaves the authenticated state intact across all federated applications. Predictable tokens reduce the brute-force cost of session forgery to practical levels.

Key Signals