Hi- my client application has reported this flaw in a recent dynamic scan. I believe we have a solution in place for this for our .Net application where the session is abandoned using .Net session.abandon which should invalidate the session when the user logouts.

The abandon method is called on the button_click event when the user logs out.

Can you please advise what else is required to address this issue?

Thanks

Dennis.