To check if an application correctly closes the session, open the application using Burp Suite and then log in to the application with valid credentials:

1. As you can see from the following screenshot, the application created a session that is used as a guest user:

2. Now, access the application, and you will see that the application now creates a new session as a logged user.
3. Close the session, as follows:

4. If the application correctly destroyed the session, it is not possible to resend a request. Go to History, and select a request made by the user.
5. Click on Send to repeated and click on Go, and see the result. If the application returns the response as a logged user, the application is vulnerable; if not, the application is not vulnerable.