What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 150 Stack Exchange communities.

Don't get me wrong, I love being automatically logging in, but what's the point of logging out unless you log out everywhere?

share|improve this question
There is no point to logging out. Stay here with us. Your so-called "co-workers" and "family members" can wait a little longer. We're your real friends. You can have some more cookies soon. –  Pops Oct 24 '10 at 4:26
Could be worse: logout fail –  Jared Harley Oct 24 '10 at 8:27

2 Answers 2

up vote 2 down vote accepted

First thing that comes to mind for me is session fixation.

From the "Logout Function" section of Wikipedia's "Session Fixation" article:

A logout function is useful as it allows users to indicate that a session should not allow further requests. Thus attacks can only be effective while a session is active.

share|improve this answer
As soon you you return to SO, it logs you back in and takes more requests... Are you talking about hacking an in progress session? –  John Oct 24 '10 at 19:44
@John - That doesn't happen to me, or if it does I don't notice; it only logs me in automatically if I'm logged in on another Stack Exchange site. –  Richard JP Le Guen Oct 25 '10 at 2:46
I guess it's possible I'm still logged in somewhere. I open a new browser, go to SE, SO, MSO, and PSE, and all except SE log me in automatically displaying a little "Welcome back John! You have been logged in." message at the top of the screen. –  John Oct 26 '10 at 3:16
This sounds familiar, but I'm fairly aggressive with cookie clearing, so kaybe that's why I don't have the same experience. Also, you ahould see @Jeff's comment below about clearing cookies. –  Richard JP Le Guen Oct 26 '10 at 4:23

I think it's currently a fairly serious problem. If I'm logged into any of the SE sites, I get auto-logged into any other one I visit. If I forget to log out of each of them, I'm stuck.

It currently means I can't access SE on a public or shared computer without clearing EVERYTHING. It's a pain.

share|improve this answer
just click "log out everywhere" on the logout page and it will clear the HTML5 Local Storage global auth cookie. But yes, you need to do this if you use a shared computer. –  Jeff Atwood Oct 24 '10 at 6:35
@Jeff Atwood - Are you sure about that? I just logged out of meta, using "Log out everywhere" and when I went back to SO and rpg.stackexchange I was still logged in there(s), though when I came back to meta I was not logged in to meta... ? –  Richard JP Le Guen Oct 26 '10 at 0:44
@leg HTML5 local storage was cleared; it doesn't clear cookies on each individual site. At the end of browsing you should clear all cookies and cache anyway using the built in browser commands -- or when you begin browsing on a shared computer use Incognito mode. –  Jeff Atwood Oct 26 '10 at 1:56
@Jeff that's the point though. If I'm using a lightly shared computer where the user doesn't want me to clear all cookies at the end of my session, I'm screwed. If I accidentally don't activate private browsing before starting, I've got a painful cleanup to do, rather than a simple "log out" button. –  Paul McMillan Oct 26 '10 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .