What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 128 Stack Exchange communities.

On the logout page for each Stack Exchange site, there is currently a button for Log Out, which logs the current session out of the current site, and a button for Log Out Everywhere, which logs all sessions out of the current site. Would it be possible for there to be a Log Out of All Sites, to log out the current session across the entire Stack Exchange network wherever the user has a linked account logged in? I sometimes work on several SE sites at once, and it's a pain to have to log out of each one individually, especially since you get logged right back in by the auto-login across sites feature if you go back to a site you've already logged out of if you're still logged in elsewhere. One click to log out of every SE site currently logged into at once would be very helpful.

share|improve this question
1  
Having read this question I'm even more confused. It implies that the log out everywhere button is supposed to do what I've just proposed, and yet the wording on the logout page and my personal experience would imply otherwise. What's going on?! –  nhinkle Jan 2 '11 at 1:58
    
My personal experience would imply that it does neither... I assume it doesn't work quite as intended, but I have only used it once and not investigated further. –  sth Jan 2 '11 at 2:51
add comment

1 Answer 1

up vote 10 down vote accepted

it's a pain to have to log out of each one individually, especially since you get logged right back in by the auto-login across sites feature if you go back to a site

Clicking "log out everywhere" clears HTML5 local storage and prevents that auto-login from happening.

it does not, and cannot, log you out across domains. Otherwise I could somehow magically log you out of facebook.com from stackoverflow.com.

edit: The buttons on this page were simplified to just Log Out, which tries to log you out in every way it can. And if you have Stack Exchange credentials the Log Out button will indeed log you out everywhere, network-wide, by redirecting you to a special network-level logout page.

share|improve this answer
2  
Would it be possible then to set the HTML5 local storage to a value that indicates that the user wishes to be logged out, and then when loading other domains, read that, and log the user out? If you can implement automatic login across sites, you should be able to implement automatic logout across sites. –  nhinkle Jan 2 '11 at 7:00
    
@nhinkle - you'd have to force the user to visit every site they have an account on (and pause for a second!) afterwards to actually cause the logout. ... Which is basically what you have to do now. Plus its hidden state, I can see the support questions now: "Every time I visit a site I'm logged out after the first page!". Throw in browser caching for extra fun, all for a very niche behavior (users logout around 1/10 as often as they login, and both are pretty rare w.r.t. the number of users in the system). –  Kevin Montrose Jan 2 '11 at 8:04
2  
@Kevin, the user would be explicitly asking to have their authentication revoked across all sites. Their intent would likely be that if somebody else were to visit the page, they would get logged out and not have access to that person's account. It wouldn't be necessary even to check the logout, as long as they knew they would get logged out if the site were accessed. My whole point is people may not remember where all they're logged in, and want to protect all their accounts at once. If the button won't do what it's purported to do, it should be removed altogether, or else clarified. –  nhinkle Jan 2 '11 at 8:12
    
@nhinkle - localStorage does not work that way. Its local, to that computer, and to that browser. There's no way to "set it" so it affects somebody else's behavior. As it is, the button does exactly what it says it does, which is logout all of your sessions everywhere for that site. –  Kevin Montrose Jan 2 '11 at 8:22
4  
@Kevin, I'm not talking about it affecting "somebody else's behavior". I'm talking about it affecting behavior in that same browser. I'm referring to Person A wanting to log out of or invalidate their login session for all SE sites in their current browser so that when Person B uses the same computer, they don't have access to Person A's SE accounts, even if Person A didn't check every single one of the 20+ SE sites to make sure they weren't logged into any of them. –  nhinkle Jan 2 '11 at 8:29
    
@Kevin Doing this should be entirely possible with local storage, by doing the exact opposite of how cross-site login works. Set a local storage value declaring the account wishes to be logged off. When a site reads that value, log out the user (if it is the same account as specified in local storage), and refresh the page. When a new user logs in or that same user logs back in, the value is removed and the auto-login value is put back into the local storage database. –  nhinkle Jan 2 '11 at 8:31
1  
@Kevin W.R.T. the button doing what it claims to, the button's action is somewhat unclear, and different answers on different meta posts indicate different functions. Furthermore, my feature-request is for a separate button to log out of all SE sites, as opposed to the current button to log all computers out of the current site. –  nhinkle Jan 2 '11 at 8:32
    
@nhinkle - if you try to use localStorage for this, Person B would still get access to your accounts. They'd just dump the cookies (every browser has a UI for this purpose, so its not even technically difficult) before they visited an SE site. Or, they'd block access to StackAuth (implicitly blocking access to StackAuth's localStorage) and just stay logged in (because we couldn't tell the cookie needed to be dropped, because we couldn't read localStorage). –  Kevin Montrose Jan 2 '11 at 8:33
1  
@Kevin, that's a possible scenario, but is limited to an extremely fringe case of people who have malicious intent and want to break into somebody's account. If somebody that malicious had access to the same computer, they could do any of a number of things like install a keylogger too. My request is for the much more likely situation of just not wanting random people to have access to one's account by just sitting down at a computer where Person A accidentally left themselves logged into a single SE site because they clicked a link to it, got logged in, and never remembered to log out. –  nhinkle Jan 2 '11 at 8:37
2  
Confused about why this is impossible. Couldn't clicking a button on one site cause the session tokens (or whatever is used) across all SE domains to be invalided, so the user will be logged out the next time he visits them? –  jrdioko Jul 15 '11 at 19:13
    
@Jeff see I knew it was possible! Thanks for finally implementing this, the logout UI is much more understandable now. –  nhinkle Jul 20 '11 at 6:09
3  
What does "Stack Exchange credentials" mean? All my SE network accounts are linked, and I have an account on stackexchange.com (all using an external OpenID), but global logout didn't work. Do you have to log in using SE's OpenID for this to work? –  Mechanical snail Aug 24 '12 at 12:22
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .