If on login page user specifies ‘remember me for a week’, which means he gets a cookie for 1 week, what is an appropriate action on logout? logout and delete his cookie with 1 week preference, or just redirect him somewhere and keep the same cookie as he asked before?
Share
What is a meaningful semantic of “remember me” if “logout” cannot undo it? Usually “remember me” means that the user comes back without needing to authenticate again, so an explicit “logout” should definitely destroy the “remembered” session and require authentication again.