In a web application, I need to implement a way to invalidate sessions to ensure security, such as when users log out or if the session becomes idle. What are the recommended methods for securely invalidating a session, and are there specific practices for managing session tokens or cookies?
If there are examples of implementing session invalidation in popular frameworks (like Express or Django), it would be helpful.