> For the complete documentation index, see [llms.txt](https://sumeru.gitbook.io/sumeru-cyber-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sumeru.gitbook.io/sumeru-cyber-security/common-vulnerabilites/access-token-not-expiring-after-logout.md).

# Access Token Not Expiring After Logout

## Introduction

The application access token is not expiring after logout.

## Impact

An attacker can use the previous access token to perform malicious activities.

## How to Test

When click the view to view the record as shown in the below screenshot.

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lv9UpLMmmAAyhFf0hfM%2Fuploads%2FTm0tUVWKTdo2lS9Ok5EP%2Ffile.png?alt=media)

* Go to the respective site (Eg: <http://192.168.43.155/view.php>)
* &#x20;Open Burp suite Community Edition. Here, is the [Blog](https://portswigger.net/burp/documentation/desktop/penetration-testing/configuring-your-browser) to configuration on your browser.&#x20;
* In burp suite, go to proxy tab and go to HTTP history. Then sent the captured above request to the repeater by right click on the packet.

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lv9UpLMmmAAyhFf0hfM%2Fuploads%2FCyqTL5DjRGfD2NYJ0nwl%2Ffile.png?alt=media)

Logged out as shown In the below screenshots

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lv9UpLMmmAAyhFf0hfM%2Fuploads%2FL58mI6fKxu05fwPcw1Ks%2Ffile.png?alt=media)

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lv9UpLMmmAAyhFf0hfM%2Fuploads%2FhU7W0nFo9pAWXTAU46s6%2Ffile.png?alt=media)

As the token is not expiring after logout we can able to view the record when we send the view request. as shown in the below screenshots

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lv9UpLMmmAAyhFf0hfM%2Fuploads%2FQmfhEKBG7EsEKNgkeCXy%2Ffile.png?alt=media)

## How to Fix

We recommend the following:

* The access token should expiry after the logout of user.
* Access token should expiry if the user closing the browser without logging out.
* Access token should have a defined time-out.

### PHP

#### Sample Code(Logout.php):

```
<?php 
session_start(); 
session_destroy();                              àIt will destroy all the session variable 
unset($_SESSION["user_name"]);   àit will destroy the particular session variable 
header("location: login.php"); 
?> 
```

#### PHP Function for Checking Login Session Timeout

#### Sample Code:

```
function isLoginSessionExpired() { 
$login_session_duration = 10;  
$current_time = time();  
if(isset($_SESSION['loggedin_time']) and isset($_SESSION["user_id"])){   
if(((time() - $_SESSION['loggedin_time']) > $login_session_duration)){  
return true;  
}  
} 
return false; 
} 
```

## References

[https://phppot.com/php/user-login-session-timeout-logout-in-php/ ](<https://phppot.com/php/user-login-session-timeout-logout-in-php/ >)