@schroeder Hi! I just wanted to apologize for being so argumentative yesterday. The truth is that I learned a lot from the conversation. About the details of the matter we discussed, and about what constitutes a good answer on this site. So, while i was indeed being very argumentative, I did learn a lot from it.

@Jacco I have written a new answer to the question, trying to incorporate what I learned. I don't believe the answer is better than the current ones, but I am submitting it for peer review if nothing else. To see if I have learned anything, and if I have been able to satisfy the quality requirements of the site. I also post this answer as a means to apologize for my argumentative behavior yesterday.

@RoryAlsop I believe I have taken a more fact based, non-assuming tone in my answer, and I hope it now matches the quality requirements of the site. If not, feel free to let me know. I promise to be more willing to learn, and avoid the argumentative tone that I took yesterday. Here is the answer: security.stackexchange.com/a/122025/105562

@Fiksdal welcome! I have no what went on or what you're referring to - but this is a very gratifying response. Often moderators question themselves if its really worth the effort of being patient with argumentative newcomers - this is the proof that patience is worth it.

@AviD Glad to hear that :)

And thanks for the welcome :)

@Fiksdal The community has already given you a stack of upvotes, and I agree with them. A much better answer. Many thanks for taking the effort.

@RoryAlsop Happy to hear it :) thanks

you got my upvote as well :-)

thanks :)

link?

@AviD security.stackexchange.com/a/122025/105562

oo long. gonna take a while :-)

:)

first few paras look good though :-)

thanks!

quick question: if session data is, upon logout, not cleared on the Server side, this means the session is open to a session fixation attack?

not necessarily, and not required

i.e. these are isometric to each other

?

what do you mean by "isometric to each other"

isometric? thats not the word I meant

typing in one window while reading in another...

they are unrelated to each other

ok, that makes more sense.

might be session fixation with a timing requirement (i.e. only works within the window of the session lifetime), or might just be bad session management but not vulnerable to fixation attacks.

basically, fixation depends on allowing the user to "choose" a session id, e.g. via URL params.

ah, then I've the terminology mixed up

of course, the situation you describe is still bad, but not necc. fixation.

its not real logout.

is there some other fancy name for this?

"Broken Logout" ?

@Jacco "bad session management" ;-)

I'll just file it under 'bad (most popular for the language) framework'.

@AviD "orthogonal"

@ThomasPornin "brain fart"

I'm already thinking about my yoga class

but yeah, thats the word I was thinking of

came out wrong

twss

lol

@Ohnana it made no sense to me either