Logout invalidates the server-side session

Clearing a session cookie on the client has no effect on a session token that was already captured — by an XSS payload, a network sniff, or a shared machine where the token was read from memory. CWE-613 (Insufficient Session Expiration) applies when logout does not invalidate the server-side session record. NIST 800-63B §7.1 (Session Bindings) requires that session termination be enforced server-side, not only client-side. OWASP A07 (Identification and Authentication Failures) lists insufficient logout among its named failure modes. The server must forget the session; the cookie clear is only a UX courtesy.

Delete the session record on the server in the same response that clears the cookie:

// src/app/api/auth/logout/route.ts
export async function POST(request: Request) {
  const sessionToken = getSessionTokenFromRequest(request)
  if (sessionToken) {
    await db.session.delete({ where: { token: sessionToken } })
  }
  const response = Response.json({ ok: true })
  response.headers.set('Set-Cookie',
    'session=; Max-Age=0; Path=/; HttpOnly; Secure; SameSite=Lax'
  )
  return response
}

For stateless JWT access tokens, add the token to a short-lived Redis blocklist on logout, or keep access token lifetime at 5–15 minutes so the window of post-logout validity is minimal.