Broken Logout Functionality

If access tokens and refresh tokens are used, see tokens in OAuth. The refresh token should be invalidated at logout.

Reporting

CVSS Score v34.3
CVSS Vector v3https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N&version=3.1

English

TitleLogout functionality leaving sensitive information
DescriptionWhen using the logout functionality in the application, some sensitive information remains in the cookies, local storage and session storage (e.g. userid).
Steps to reproduceLog into the application.
Using the browser Inspector (Firefox was used during the tests), inspect the cookies, local storage and session storage to see if the log out functionality left sensitive information.
Log out.
Include screenshots.
RemediationIt is recommended to remove sensitive information from cookies, local storage and session storage when the user logs out of the application.
Difficulty level to fix this vulnerability is assessed at “Simple”.