a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member” of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) ") else: return HttpResponse("Your username and password didn't match.") …And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member”of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) logged in.") else: return HttpResponse("Your username and password didn't match.") . . .And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session['has_commented'] = True return HttpResponse('Thanks for your comment!') This simplistic view logs in a “member” of the site: def login(request): m = Member.objects.get(username=request.POST['username']) ") else: return HttpResponse("Your username and password didn't match.") …And this one logs a member out, according to login() above: def logout(request): try: del request.session['member_id']

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session['has_commented'] = True return HttpResponse('Thanks for your comment!') This simplistic view logs in a “member” of the site: def login(request): m = Member.objects.get(username=request.POST['username']) logged in.") else: return HttpResponse("Your username and password didn't match.") ...And this one logs a member out, according to login() above: def logout(request): try: del request.session['member_id']

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session['has_commented'] = True return HttpResponse('Thanks for your comment!') This simplistic view logs in a “member” of the site: def login(request): m = Member.objects.get(username=request.POST['username']) ") else: return HttpResponse("Your username and password didn't match.") …And this one logs a member out, according to login() above: def logout(request): try: del request.session['member_id']

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member”of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) previous page) else: return HttpResponse("Your username and password didn't match.") . . .And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member” of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) ") else: return HttpResponse("Your username and password didn't match.") …And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member”of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) previous page) else: return HttpResponse("Your username and password didn't match.") . . .And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member” of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) ") else: return HttpResponse("Your username and password didn't match.") …And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]

a user logs out, cookie-based sessions are not invalidated when a user logs out. Thus if an attacker steals a user’s cookie, they can use that cookie to login as that user even if the user logs out. Cookies session["has_commented"] = True return HttpResponse("Thanks for your comment!") This simplistic view logs in a “member”of the site: def login(request): m = Member.objects.get(username=request.POST["username"]) previous page) else: return HttpResponse("Your username and password didn't match.") . . .And this one logs a member out, according to login() above: def logout(request): try: del request.session["member_id"]