In FreeIPA 4.9.2 (latest on CentOS 8), when you explicitly log out from the web interface you are redirected to the login page, however, the cookie can still be used.

We would expect that the session would be invalidated on the server-side when a user logs out.

The danger is that if a cookie is stolen, a logout action is now ineffective in limiting the window of opportunity for an attacker.

I found a similar issue for an older version of FreeIPA and in theory this was fixed.
https://pagure.io/freeipa/issue/6685

In practice, however, the issue is there.