title: Web application security
body: <p>I am testing a web application for security holes and I came across the following 2 cases.</p>
  
  <ol>
  <li><p>Using a proxy, I intercept all requests going through to the application and save all cookies. Using these saved cookies, I am able to recover the session on a different machine and access the user's personal info without any further authentication. I am thinking any admin could pull this sort of thing and gain access to the personal information of all users on the network.</p></li>
  <li><p>Same as  case 1, but I am able to recover the session on a different machine <em>even after the original user has properly logged out</em>. i.e the session seems to remain valid on the server even after the original user has logged out and all session related cookies are removed on the client-side.</p></li>
  </ol>
  
  <p>I am fairly certain that case 2 is a security flaw in the web application. I am wondering if case 1 could also technically be considered a vulnerability in the web application. If so, what are some ways to fix this?</p>