i have recently encountered problem for my app with insufficient session expiration.Basically we have session storage field that contains user token , like that for some more we have tokens. On logout since we are using SSO , we are clearing user session only not other data. we have recently reported this problem.
what might be the solution
To properly cancel the user's session, you should not only delete the local session token, but also cancel the token with the SSO provider.
You don't specify who you are authenticating with, but every reputable SSO provider should have a sign out or log out option which will invalidate their session at the back-end. Then you can delete the user token since it is no longer valid, and no malicious 3rd party will be able to use a session that is secretly still active.