Timeline for Log out of all Stack Exchange sites with linked account simultaneously
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 24, 2012 at 12:22 | comment | added | Mechanical snail |
What does "Stack Exchange credentials" mean? All my SE network accounts are linked, and I have an account on stackexchange.com (all using an external OpenID), but global logout didn't work. Do you have to log in using SE's OpenID for this to work?
|
|
| Jul 20, 2011 at 6:09 | comment | added | nhinkle | @Jeff see I knew it was possible! Thanks for finally implementing this, the logout UI is much more understandable now. | |
| Jul 20, 2011 at 6:09 | vote | accept | nhinkle | ||
| Jul 16, 2011 at 3:28 | history | edited | Jeff Atwood | CC BY-SA 3.0 |
added 288 characters in body
|
| Jul 15, 2011 at 19:13 | comment | added | jrdioko | Confused about why this is impossible. Couldn't clicking a button on one site cause the session tokens (or whatever is used) across all SE domains to be invalided, so the user will be logged out the next time he visits them? | |
| Jan 2, 2011 at 8:37 | comment | added | nhinkle |
@Kevin, that's a possible scenario, but is limited to an extremely fringe case of people who have malicious intent and want to break into somebody's account. If somebody that malicious had access to the same computer, they could do any of a number of things like install a keylogger too. My request is for the much more likely situation of just not wanting random people to have access to one's account by just sitting down at a computer where Person A accidentally left themselves logged into a single SE site because they clicked a link to it, got logged in, and never remembered to log out.
|
|
| Jan 2, 2011 at 8:33 | comment | added | Kevin Montrose |
@nhinkle - if you try to use localStorage for this, Person B would still get access to your accounts. They'd just dump the cookies (every browser has a UI for this purpose, so its not even technically difficult) before they visited an SE site. Or, they'd block access to StackAuth (implicitly blocking access to StackAuth's localStorage) and just stay logged in (because we couldn't tell the cookie needed to be dropped, because we couldn't read localStorage).
|
|
| Jan 2, 2011 at 8:32 | comment | added | nhinkle | @Kevin W.R.T. the button doing what it claims to, the button's action is somewhat unclear, and different answers on different meta posts indicate different functions. Furthermore, my feature-request is for a separate button to log out of all SE sites, as opposed to the current button to log all computers out of the current site. | |
| Jan 2, 2011 at 8:31 | comment | added | nhinkle | @Kevin Doing this should be entirely possible with local storage, by doing the exact opposite of how cross-site login works. Set a local storage value declaring the account wishes to be logged off. When a site reads that value, log out the user (if it is the same account as specified in local storage), and refresh the page. When a new user logs in or that same user logs back in, the value is removed and the auto-login value is put back into the local storage database. | |
| Jan 2, 2011 at 8:29 | comment | added | nhinkle |
@Kevin, I'm not talking about it affecting "somebody else's behavior". I'm talking about it affecting behavior in that same browser. I'm referring to Person A wanting to log out of or invalidate their login session for all SE sites in their current browser so that when Person B uses the same computer, they don't have access to Person A's SE accounts, even if Person A didn't check every single one of the 20+ SE sites to make sure they weren't logged into any of them.
|
|
| Jan 2, 2011 at 8:22 | comment | added | Kevin Montrose | @nhinkle - localStorage does not work that way. Its local, to that computer, and to that browser. There's no way to "set it" so it affects somebody else's behavior. As it is, the button does exactly what it says it does, which is logout all of your sessions everywhere for that site. | |
| Jan 2, 2011 at 8:12 | comment | added | nhinkle | @Kevin, the user would be explicitly asking to have their authentication revoked across all sites. Their intent would likely be that if somebody else were to visit the page, they would get logged out and not have access to that person's account. It wouldn't be necessary even to check the logout, as long as they knew they would get logged out if the site were accessed. My whole point is people may not remember where all they're logged in, and want to protect all their accounts at once. If the button won't do what it's purported to do, it should be removed altogether, or else clarified. | |
| Jan 2, 2011 at 8:04 | comment | added | Kevin Montrose | @nhinkle - you'd have to force the user to visit every site they have an account on (and pause for a second!) afterwards to actually cause the logout. ... Which is basically what you have to do now. Plus its hidden state, I can see the support questions now: "Every time I visit a site I'm logged out after the first page!". Throw in browser caching for extra fun, all for a very niche behavior (users logout around 1/10 as often as they login, and both are pretty rare w.r.t. the number of users in the system). | |
| Jan 2, 2011 at 7:00 | comment | added | nhinkle | Would it be possible then to set the HTML5 local storage to a value that indicates that the user wishes to be logged out, and then when loading other domains, read that, and log the user out? If you can implement automatic login across sites, you should be able to implement automatic logout across sites. | |
| Jan 2, 2011 at 4:32 | history | answered | Jeff Atwood | CC BY-SA 2.5 |