ASVS 5.0 V7.4.4 (Level 2) requires that every page behind authentication gives the user a simple, visible way to log out. It is not enough for logout to exist somewhere in a settings menu.
Why it matters
Users on shared or public machines need a fast exit. If logout is buried, they close the tab instead, and the session stays alive until the timeout.
How to implement it
Place logout in the shared layout so no page can omit it. Use a form with POST, not a link, so prefetchers and image tags cannot log users out.
<form method="post" action="/logout">
<input type="hidden" name="csrf_token" value="TOKEN_FROM_SERVER">
<button type="submit">Log out</button>
</form>
Server side, the handler must destroy the session on the backend (see V7.4.1), not just clear a cookie. Include it in modal flows, full screen editors and mobile web views as well.
How to test it
Crawl the authenticated app and assert that every response with HTML contains a logout control. A quick Playwright loop over your sitemap does it. Then click it on three pages and confirm the old cookie is rejected.
Common mistakes
- Logout as a GET link that a browser can prefetch.
- Hiding it inside a collapsed menu on mobile.
- Single page apps that drop the control on special routes.
Quick check
Does a timeout count as visible logout?
No. The requirement is a control the user can reach on demand, on every authenticated page.
