Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)

Summary

This report identified a session management behavior in Shopify where, after logging out, the session associated with a user is not immediately invalidated on the server side. The researcher demonstrated the ability to reuse session cookies after logout, potentially allowing an attacker to regain access to the account if they possess the session cookie prior to logout.

The concern raised was that this behavior could enable an attacker to take over a Shopify account using old cookies if they exploit another vulnerability to obtain them. However, Shopify's review concluded that this is a common authentication pattern that allows users to remain logged in across multiple devices for convenience.

Shopify provides a "Log out of all devices" feature for users who wish to terminate all sessions actively. The behavior was judged to be intentional and not a security vulnerability, reinforcing that users have control over their session management. Consequently, the report was classified as Informative, as the findings did not demonstrate an exploitable security issue or direct impact on the confidentiality, integrity, or availability of user accounts.