Wt

Currently, when a user logs out of the application, with any functionality that call logout(), this will:

• mark the user as being logged out
• remove the login cookie, if this mechanism is enabled (which it is by default)

This does NOT yet clear the cookie from the server's database. This can lead to a flaw where the user:

• logs in with "Remember me" selected
• opens their console, and copies the cookie's name and value
• logs out (and the cookie is removed from their browser)
• creates a new cookie, with the copied name and value
• refreshes the page

After all this, the result will be that they are now logged in again, due to the cookie being detected on the server side, since it was not deleted from its persisted storage.
This should be the case.