Fully invalidate sessions

Session destruction/logout must invalidate the session at every layer: both the client-side cookie/session identifier and the corresponding server-side stored session data. Never implement a default “no-op” or partial destroy method in a base/interface class, since that can silently leave the underlying store intact. If only the cookie is cleared, an attacker who has captured the old cookie value can replay it and still access the authenticated session data, even though the legitimate user believes they have logged out. Each concrete session interface implementation must explicitly clear/delete its backing store entry (e.g., cache, database row, file) in addition to clearing any session content, for example:

def destroy_session(self, app, session):
    # Remove data from the underlying store (e.g., cache/db), not just the cookie
    self.cache.delete(self.get_session_store_key(session))
    session.clear()

When adding or reviewing any logout, session-expiry, or session-regeneration logic, verify both halves (cookie and store) are torn down together to prevent session reuse/fixation attacks.