# Session does need to be terminated when actively logging out

**URL:** <https://forum.opensearch.org/t/session-does-need-to-be-terminated-when-actively-logging-out/3814>\
**Category:** Security\
**Created:** [September 23, 2020, 2:13pm UTC](https://forum.opensearch.org/t/session-does-need-to-be-terminated-when-actively-logging-out/3814 "2020-09-23T14:13:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![francobep](https://avatars.discourse-cdn.com/v4/letter/f/858c86/32.png) [@francobep](https://forum.opensearch.org/u/francobep)\
**Post date:** [September 23, 2020, 2:13pm UTC](https://forum.opensearch.org/t/session-does-need-to-be-terminated-when-actively-logging-out/3814/1 "2020-09-23T14:13:27Z")

</div>

Hi all!

I am using the latest stable version of OpenDistro. For authentication, I have the basic form configured. This one works perfect, I can successfully authenticate from Kibana.

I have a problem with the log out from Kibana and the session invalidation.

My situation is the following, I access Kibana with login, I capture a request from the browser and I start repeating this request in a loop.

Then I log out from Kibana and in the browser, I actually log out but the request remains valid for the lifetime of the session.

How can I invalidate the session when I log out of Kibana?

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [April 14, 2021, 6:59pm UTC](https://forum.opensearch.org/t/session-does-need-to-be-terminated-when-actively-logging-out/3814/2 "2021-04-14T18:59:55Z")

</div>

Hi @francobep can you outline the exact steps you take. Do you use 2 separate browsers? Does the original captured communication include basic authentication?  
Can you also confirm which odfe version you are using?