Logout clears client+server session data within 1s

A logout that only clears client-side state — localStorage, React context, or a cookie set to Max-Age=0 without server-side destruction — leaves the server-side session record valid. Any actor who captured the session token (via network sniff, log file, browser extension, or XSS) can replay it after the user 'logged out' and regain full access. CWE-613 defines this as insufficient session expiration. OWASP A07 (Identification and Authentication Failures) and PCI-DSS Req 8.2.6 both require server-side invalidation. The consequence in a financial context is that post-logout token replay enables transfers, account changes, and data exfiltration on an account the user believed was secured.

Implement all four cleanup steps in src/app/api/auth/logout/route.ts — server destruction, token invalidation, cookie clearing, and client state reset must complete atomically:

export async function POST(req: Request) {
  const session = await getSession(req);
  if (session) {
    await sessionStore.destroy(session.id);        // 1. server session gone
    await tokenBlacklist.add(session.token);       // 2. token invalidated
  }
  const response = new Response(JSON.stringify({ ok: true }), { status: 200 });
  // 3. clear cookies server-side
  response.headers.set('Set-Cookie',
    'sessionId=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0');
  response.headers.set('Set-Cookie',
    'authToken=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0');
  return response;
}

Client-side cleanup (step 4 — localStorage.clear(), sessionStorage.clear()) must run in the calling component after the server response confirms destruction, not in lieu of it.