Issue Summary:

Web applications that do not ensure  that all session tokens  (e.g.: cookies) are  properly destroyed or  made unusable, are  prone to session  replay where an  attacker steals the  session identifier by  sniffing and replays  these session tokens  to "resurrect" the  session of a  legitimate user and  virtually impersonate  him/her.

Suggestion:

In order to help mitigate these types of situations, perhaps we could implement specific features such as, but not exclusive to: 

• More granular session controls in the UI that the application to allow the administrator to control default session timeout without having to modify system files or similar. 
• Allow the logout button to terminal all sessions for the user
• Perform additional checks on the session state and contribute additional factors to the related cookie to harden the session