Even if an RP successfully terminates the server-side session, client-side state in the user's browser (such as locally stored access tokens) may remain briefly valid; complete logout requires combining back-channel logout with front-channel logout or short-lived tokens.