Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 153 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I see that this question is asked over and over again.

I made a point to use Stack Exchange rather than Facebook or Gmail to login, as I recently had to do some major annoying stuff to keep Spotify while considering to shut down my Facebook.

I want to be able to logout of Stack Exchange and Stack Overflow by clicking logout. And I want this to force the next login to actually ask for a password.

I want to know what to do rather than why this happens and understanding the details of OpenID. I have tried both doing a logout from StackOverflow.com and also StackExchange.com and it will always let me log back in without asking the username or password, unless I delete the cookies. I understand that other similar questions say that this is not a bug, so I just need a clear way to do it, as looking at other posts considered "duplicate" link to another question that's either not clear or is 2011 or older.

share|improve this question

closed as off-topic by Adam Lear Nov 25 '15 at 0:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "The problem described here can no longer be reproduced. Changes to the system or to the circumstances affecting the asker have rendered it obsolete. If you encounter a similar problem, please post a new question." – Adam Lear
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Need the answer to this question. The part about next login actually asking for a password is really important. I want to use this website but there is this security concern due to this auto-login feature. – Aseem Bansal May 19 '13 at 12:55
    
Log out of all your OpenID providers you registered with your account, perhaps? – Martijn Pieters Aug 16 '13 at 10:37
    
With the new login system in place, this should no longer be an issue. We ask for your email/password whenever you log out of the sites. – Adam Lear Nov 25 '15 at 0:21
    
@adam-lear Not true. I just tripped over the difference between StackExchange as an openid credential versus logging out of StackExchange site. To actually logout I had to go to openid.stackexchange.com and logout there AS WELL. And no, the last sentence on the logout page does NOT make that clear. – BillR Dec 3 '15 at 22:27

Same problem still present - no password entry required to log in

I basically had the same problem today.

I am a new user, but my email was verified and the account registration completed.

I'm not [yet] using StackOverflow that way and I did not verify that part of the problem.

Apparently it does not make a difference from where I log out...

meta.stackexchange.com requires me to provide the password to log in
-> expected and appreciated behaviour. ,/

http://stackexchange.com/ however only requires me to select the openid provider to "log in"
-> a few mouseclicks
->no password required X

This raises the question, why there are links to log out at all.
They do not provide the additional security, their presence suggests!

Anyone who can get his hands on that browser [profile] could just [mis]use my account.
- unless I can and do clear the corresponding cookies.
(I removed all stackexchange cookies, after that I was required to provide a password to log in.)

[One of] the logout links should also remove the corresponding cookie[s]!

I have however found none that does.

I have carried that problem as far as I could at the moment.

Hopefully that will somehow bring us closer to a useful solution.

An idea for a workaround

I do have an idea, how this problem could be worked around - until a real solution is known and available.

(There may be obstacles, I do not yet know about and I do not know if or when I would get to implementing it.)

  • Find out what cookie[s] are relevant for that auto log in.
  • Create a bookmarklet to use for logout - at least to remove those relevant cookies.

I guess that would require the user to be able to add that bookmarklet to the browsers bookmarks, else I don't know how that could help (a user sharing a browser with others...).

I'm also one who would appreciate better solutions or even code implementing my limited suggestion.

Progress for workaround

(Editing as/if more news are available...)

I believe, I identified the relevant cookie:

site: openid.stackexchange.com
cookie name: usr

...

Solution

Ok, it seems I have found a real solution now:

This apparently logs you out of that openid provider account properly.
In that process the above cookie will be removed. Your logout will also be logged among your other related activities that way.

Perhaps stackexchange could provide that link at it's logout page.(?)
(If there is, I have not found it so far.)

Even then a complete logout will require (at least) 4 clicks...

share|improve this answer
1  
You know, you can simply browse Incognito. No logout required. – Shadow Wizard Aug 26 '15 at 19:49
    
@ShadowWizard - Of course, but where is the real fun and action..., sticking to only browsing? ;-) – Martin Aug 26 '15 at 20:30
    
Hah, funny, 2 years later, people still wondering about it :-) BTW if I go to that link, when logged in here on meta.stackexchange.com, over at openid.stackexchange.com/account/logout -- it says "Not Found" -- it doesn't see me as logged in over there. If I login and then logout there, it still shows me as logged in here. – Tom Aug 27 '15 at 19:55
    
@Tom - it is expected that the logout resource is only available when you are logged in at openid.stackexchange.com. So is the fact that the established login at [meta.]stackexchange.com continues to be valid until you log out [t]here. About the aspect of needing credentials to log in again (especially the password) - it does work for me, if I am logged out of both - I would think it should work for others as well - as long as the browser is not set up to store/enter the credentials... – Martin Aug 29 '15 at 18:12
    
I said: "meta.stackexchange.com requires me to provide the password to log in -> expected and appreciated behaviour. ,/" -> correction: I can instead provide my openid provider openid.stackexchange.com so I only need to click on a confirm button (depending on the session context maybe not even that). – Martin Aug 29 '15 at 18:21

Tom said:
"I made a point to use Stack Exchange rather than Facebook or Gmail to login" ...

Your openid provider is openid.stackexchange.com in that case.

Otherwise it is just the same procedure as with any other openid provider:

You need to log out at that provider as well, to be logged out completely in that context.

A helpful habit to deal with that could be to always go to
https://openid.stackexchange.com/ to log in, leave that tab open,
then open other pages (in other tabs) you may want to use with that login, f.e. stackexchange,
logging out at that openid provider when you no longer need it for that session...

As an alternative, you could use the logout link, I provided in my original answer:
https://openid.stackexchange.com/account/logout to log out of the openid provider.

Always remember to click on the buttons for the confirmation of the logouts as well!
- else you will not be (completely) logged out.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .