what i propose: 1) login = sending username and hashed password (over tls) that does a bcrypt etc, compares to bcrypted etc hash in db, if correct = provide a jwt set as a cookie with "secure httpOnly", jwt should be logged.

2) logout = request to server, server sets cookie with "token=empty;expires:1970yaddayadda" as it's httpOnly there's no client-side messing baout with the cookie otherwise

3)_all pages send cookie with each request, so must be tls

upon logout, cookie has empty token, must be re-set with new token. old token, if stolen, can be compared with logged history, etc.

what do you see, in terms of flaws?