What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Don't get me wrong, I love being automatically logging in, but what's the point of logging out unless you log out everywhere?

share|improve this question
13  
There is no point to logging out. Stay here with us. Your so-called "co-workers" and "family members" can wait a little longer. We're your real friends. You can have some more cookies soon. –  Pops Oct 24 '10 at 4:26
4  
Could be worse: logout fail –  Jared Harley Oct 24 '10 at 8:27

2 Answers 2

up vote 2 down vote accepted

First thing that comes to mind for me is session fixation.

From the "Logout Function" section of Wikipedia's "Session Fixation" article:

A logout function is useful as it allows users to indicate that a session should not allow further requests. Thus attacks can only be effective while a session is active.

share|improve this answer
    
As soon you you return to SO, it logs you back in and takes more requests... Are you talking about hacking an in progress session? –  John Oct 24 '10 at 19:44
    
@John - That doesn't happen to me, or if it does I don't notice; it only logs me in automatically if I'm logged in on another Stack Exchange site. –  Richard JP Le Guen Oct 25 '10 at 2:46
    
I guess it's possible I'm still logged in somewhere. I open a new browser, go to SE, SO, MSO, and PSE, and all except SE log me in automatically displaying a little "Welcome back John! You have been logged in." message at the top of the screen. –  John Oct 26 '10 at 3:16
    
This sounds familiar, but I'm fairly aggressive with cookie clearing, so kaybe that's why I don't have the same experience. Also, you ahould see @Jeff's comment below about clearing cookies. –  Richard JP Le Guen Oct 26 '10 at 4:23

I think it's currently a fairly serious problem. If I'm logged into any of the SE sites, I get auto-logged into any other one I visit. If I forget to log out of each of them, I'm stuck.

It currently means I can't access SE on a public or shared computer without clearing EVERYTHING. It's a pain.

share|improve this answer
3  
just click "log out everywhere" on the logout page and it will clear the HTML5 Local Storage global auth cookie. But yes, you need to do this if you use a shared computer. –  Jeff Atwood Oct 24 '10 at 6:35
    
@Jeff Atwood - Are you sure about that? I just logged out of meta, using "Log out everywhere" and when I went back to SO and rpg.stackexchange I was still logged in there(s), though when I came back to meta I was not logged in to meta... ? –  Richard JP Le Guen Oct 26 '10 at 0:44
1  
@leg HTML5 local storage was cleared; it doesn't clear cookies on each individual site. At the end of browsing you should clear all cookies and cache anyway using the built in browser commands -- or when you begin browsing on a shared computer use Incognito mode. –  Jeff Atwood Oct 26 '10 at 1:56
    
@Jeff that's the point though. If I'm using a lightly shared computer where the user doesn't want me to clear all cookies at the end of my session, I'm screwed. If I accidentally don't activate private browsing before starting, I've got a painful cleanup to do, rather than a simple "log out" button. –  Paul McMillan Oct 26 '10 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .