Sign Out Feature Does Not Terminate Session Properly #379
Description
Environment:
- Browser: Chrome Version 139.0.7258.139
- OS: Windows 11
Preconditions:
User account exists with valid credentials.
Steps to Reproduce:
- Log in with valid credentials.
- Click the “Sign Out” button.
- After logout, open page source.
- Manually delete "div" containing the “Log In” button.
- Delete "div" with gray background overlay.
- Attempt to remove an existing patient record.
Expected Result:
After logging out, the session should be fully terminated.
User should be redirected to login page.
Application should prevent any interaction or content modification without valid authentication.
Actual Result:
User can still interact with and edit page content after logging out by manipulating the DOM, indicating that logout only hides the UI instead of fully ending the session.
Notes/Suggestions:
Ensure server-side session is invalidated upon logout.
Protect endpoints with authentication checks (not just UI restrictions).
