---
title: "Verify logout blocks protected history and fresh requests"
description: "Exercise sign-out followed by browser history, reload, and direct private navigation to separate cached page appearance from active session access."
canonical_url: "https://vostride.com/agent-library/authentication/logout-protected-history.md"
md_url: "https://vostride.com/agent-library/authentication/logout-protected-history.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify logout blocks protected history and fresh requests

Exercise sign-out followed by browser history, reload, and direct private navigation to separate cached page appearance from active session access.

## Risk

Logout may clear a menu while leaving the server session usable. A history snapshot can also display stale confidential content even when a subsequent request is denied, so browser and server observations need separate acceptance criteria.

## Fixtures

- A disposable account with a private note containing a unique run marker.
- A documented product policy for whether protected history snapshots must be obscured immediately.
- A registered session check hook that can verify revocation without exposing the session credential.

## Steps

1. Sign in through the product and open the private note; verify the marker and signed-in account are visible.
2. Use the product sign-out control and verify the signed-out destination and removal of authenticated navigation.
3. Go back through browser history; verify behavior matches the protected-history policy and record any visible cached note separately.
4. Reload that page and then open the private URL directly; verify both requests lead to sign-in or the documented access-denied page.
5. Run the session check hook and verify the former session is rejected; sign in again and verify normal access still works.

## Expected results

- The logout operation invalidates the active session as reported by the application check.
- A fresh private-page request cannot return the note contents after logout.
- Browser-history behavior matches the explicit product policy rather than an assumed universal browser behavior.

## False-pass traps

- A hidden account menu is insufficient evidence of server-side logout.
- A cached screenshot and a newly authorized response are different outcomes and must not be merged into one verdict.

## Cleanup

- Remove the test note and revoke any session created during the final sign-in check.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)