On the logout page for each Stack Exchange site, there is currently a button for Log Out, which logs the current session out of the current site, and a button for Log Out Everywhere, which logs all sessions out of the current site. Would it be possible for there to be a Log Out of All Sites, to log out the current session across the entire Stack Exchange network wherever the user has a linked account logged in? I sometimes work on several SE sites at once, and it's a pain to have to log out of each one individually, especially since you get logged right back in by the auto-login across sites feature if you go back to a site you've already logged out of if you're still logged in elsewhere. One click to log out of every SE site currently logged into at once would be very helpful.
-
1Having read this question I'm even more confused. It implies that the log out everywhere button is supposed to do what I've just proposed, and yet the wording on the logout page and my personal experience would imply otherwise. What's going on?!– nhinkleCommented Jan 2, 2011 at 1:58
-
My personal experience would imply that it does neither... I assume it doesn't work quite as intended, but I have only used it once and not investigated further.– sthCommented Jan 2, 2011 at 2:51
Add a comment
|
1 Answer
it's a pain to have to log out of each one individually, especially since you get logged right back in by the auto-login across sites feature if you go back to a site
Clicking "log out everywhere" clears HTML5 local storage and prevents that auto-login from happening.
it does not, and cannot, log you out across domains. Otherwise I could somehow magically log you out of facebook.com from stackoverflow.com.
edit: The buttons on this page were simplified to just Log Out, which tries to log you out in every way it can. And if you have Stack Exchange credentials the Log Out button will indeed log you out everywhere, network-wide, by redirecting you to a special network-level logout page.
answered Jan 2, 2011 at 4:32
-
2Would it be possible then to set the HTML5 local storage to a value that indicates that the user wishes to be logged out, and then when loading other domains, read that, and log the user out? If you can implement automatic login across sites, you should be able to implement automatic logout across sites.– nhinkleCommented Jan 2, 2011 at 7:00
-
@nhinkle - you'd have to force the user to visit every site they have an account on (and pause for a second!) afterwards to actually cause the logout. ... Which is basically what you have to do now. Plus its hidden state, I can see the support questions now: "Every time I visit a site I'm logged out after the first page!". Throw in browser caching for extra fun, all for a very niche behavior (users logout around 1/10 as often as they login, and both are pretty rare w.r.t. the number of users in the system). Commented Jan 2, 2011 at 8:04
-
2@Kevin, the user would be explicitly asking to have their authentication revoked across all sites. Their intent would likely be that if somebody else were to visit the page, they would get logged out and not have access to that person's account. It wouldn't be necessary even to check the logout, as long as they knew they would get logged out if the site were accessed. My whole point is people may not remember where all they're logged in, and want to protect all their accounts at once. If the button won't do what it's purported to do, it should be removed altogether, or else clarified.– nhinkleCommented Jan 2, 2011 at 8:12
-
@nhinkle - localStorage does not work that way. Its local, to that computer, and to that browser. There's no way to "set it" so it affects somebody else's behavior. As it is, the button does exactly what it says it does, which is logout all of your sessions everywhere for that site. Commented Jan 2, 2011 at 8:22
-
5@Kevin, I'm not talking about it affecting "somebody else's behavior". I'm talking about it affecting behavior in that same browser. I'm referring to
Person Awanting to log out of or invalidate their login session for all SE sites in their current browser so that whenPerson Buses the same computer, they don't have access toPerson A's SE accounts, even ifPerson Adidn't check every single one of the 20+ SE sites to make sure they weren't logged into any of them.– nhinkleCommented Jan 2, 2011 at 8:29 -
@Kevin Doing this should be entirely possible with local storage, by doing the exact opposite of how cross-site login works. Set a local storage value declaring the account wishes to be logged off. When a site reads that value, log out the user (if it is the same account as specified in local storage), and refresh the page. When a new user logs in or that same user logs back in, the value is removed and the auto-login value is put back into the local storage database.– nhinkleCommented Jan 2, 2011 at 8:31
-
1@Kevin W.R.T. the button doing what it claims to, the button's action is somewhat unclear, and different answers on different meta posts indicate different functions. Furthermore, my feature-request is for a separate button to log out of all SE sites, as opposed to the current button to log all computers out of the current site.– nhinkleCommented Jan 2, 2011 at 8:32
-
@nhinkle - if you try to use localStorage for this,
Person Bwould still get access to your accounts. They'd just dump the cookies (every browser has a UI for this purpose, so its not even technically difficult) before they visited an SE site. Or, they'd block access to StackAuth (implicitly blocking access to StackAuth's localStorage) and just stay logged in (because we couldn't tell the cookie needed to be dropped, because we couldn't read localStorage). Commented Jan 2, 2011 at 8:33 -
1@Kevin, that's a possible scenario, but is limited to an extremely fringe case of people who have malicious intent and want to break into somebody's account. If somebody that malicious had access to the same computer, they could do any of a number of things like install a keylogger too. My request is for the much more likely situation of just not wanting random people to have access to one's account by just sitting down at a computer where
Person Aaccidentally left themselves logged into a single SE site because they clicked a link to it, got logged in, and never remembered to log out.– nhinkleCommented Jan 2, 2011 at 8:37 -
3Confused about why this is impossible. Couldn't clicking a button on one site cause the session tokens (or whatever is used) across all SE domains to be invalided, so the user will be logged out the next time he visits them?– jrdiokoCommented Jul 15, 2011 at 19:13
-
@Jeff see I knew it was possible! Thanks for finally implementing this, the logout UI is much more understandable now.– nhinkleCommented Jul 20, 2011 at 6:09
-
3What does "Stack Exchange credentials" mean? All my SE network accounts are linked, and I have an account on
stackexchange.com(all using an external OpenID), but global logout didn't work. Do you have to log in using SE's OpenID for this to work? Commented Aug 24, 2012 at 12:22