diff --git a/controllers/app-auth.go b/controllers/app-auth.go
index b79902e..32ed3f3 100644
--- a/controllers/app-auth.go
+++ b/controllers/app-auth.go
@@ -125,15 +125,21 @@ func AppSignout(c *core.Context) *core.Response {
 	// get cookie
 	usercookie, err := c.GetCookie()
 	if err != nil {
+		// the cookie could not be read/decrypted, still make sure it is removed from the client
+		core.ClearCookie(c.Response.HttpResponseWriter)
 		return c.Response.Redirect("/applogin")
 	}
 	token = usercookie.Token
 
 	if token == "" {
+		// no token present, still clear any (possibly present) cookie on the client
+		core.ClearCookie(c.Response.HttpResponseWriter)
 		return c.Response.Redirect("/applogin")
 	}
 	payload, err := c.GetJWT().DecodeToken(token)
 	if err != nil {
+		// the token is invalid, clear the cookie on the client
+		core.ClearCookie(c.Response.HttpResponseWriter)
 		return c.Response.Redirect("/applogin")
 	}
 	userAgent := c.GetUserAgent()
@@ -141,9 +147,15 @@ func AppSignout(c *core.Context) *core.Response {
 
 	err = c.GetCache().Delete(hashedCacheKey)
 	if err != nil {
+		// failed to invalidate the cached token, still clear the cookie on the client
+		core.ClearCookie(c.Response.HttpResponseWriter)
 		return c.Response.Redirect("/applogin")
 	}
 
+	// successful signout: the token is removed from the cache, also clear
+	// the cookie on the client before the final redirect
+	core.ClearCookie(c.Response.HttpResponseWriter)
+
 	return c.Response.Redirect("/applogin")
 }