More specifically, the logout function must ensure that all session tokens (e.g.: cookies) are properly destroyed or made unusable, and that proper controls are enforced at the server side to forbid them to be used again. ???Note: the most important thing is for the application to invalidate the session on the server side.