For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Applies when

The project it has user accounts.

How to do it

The OWASP Session Management Cheat Sheet asks for a visible sign-out in the header or menu, reachable from every page. NIST SP 800-63B-4 asks for an easy way to end a session. People on shared or borrowed computers need it most. Put it in the shared layout, so no page can leave it out. Make it a form that posts, so a link cannot sign someone out from another site. Delete the session row, as let people sign out of one device or all of them does. Clear browser data as clear site data on sign-out says.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

import { test, expect } from '@playwright/test';
import { signedInRoutes } from './routes.js';

for (const route of signedInRoutes) {
  test(`sign-out is one click away on ${route}`, async ({ page }) => {
    await page.goto(route);
    const signOut = page.getByRole('button', { name: 'Sign out' });
    if (!(await signOut.isVisible())) await page.getByRole('button', { name: 'Menu' }).click();
    await expect(signOut).toBeVisible();
  });
}

Python example

import pytest
from playwright.sync_api import Page, expect
from routes import SIGNED_IN_ROUTES

@pytest.mark.parametrize("route", SIGNED_IN_ROUTES)
def test_sign_out_one_click_away(signed_in_page: Page, route: str):
    signed_in_page.goto(route)
    sign_out = signed_in_page.get_by_role("button", name="Sign out")
    if not sign_out.is_visible():
        signed_in_page.get_by_role("button", name="Menu").click()
    expect(sign_out).to_be_visible()

How to check

A browser test signs in and opens every signed-in route, at phone and desktop width. Each page has a sign-out control within one click. After using it, the old cookie gets 401.

Sources

• OWASP Session Management Cheat Sheet on the logout button
• NIST SP 800-63B-4 on session management

Related rules

• Let people sign out of one device or all of them in Accounts
• Wipe browser data on sign-out in Website