I have an ASP.NET 4.8 MVC application. I am using form authentications. Recently I have discovered that pages are accessible for a period of time 0-5min even after logged out.

This is only happening when using the BurpSuite tool with the help of Repeater. This is happening only for a time period of not more than 5 minutes. From the browser, it is 100% unable to access pages after logout. I am confused about how only the BurpSuite Repeater can access protected pages even after logging out.

I do not use any server caching.