20

I've logged in to my account using Stack Exchange OpenID. That is, I just clicked the "log in" link in the top bar, and typed in my e-mail address and password.

When I now want to log out again, clicking the "log out" link in the top bar menu, takes me to a logout page that helpfully notes:

If you're on a shared computer, remember to log out of your Open ID provider (Facebook, Google, Stack Exchange, etc.) as well.

Screenshot:

Screenshot

Alas, the page completely fails to explain how to do that. Facebook and Google, of course, have their own logout links in their own user interface, but the Stack Exchange OpenID provider, and its logout page, is completely hidden from normal users.

Of course, I've been around for a while, and I've spent some time hacking the SE interface, so I happened to know that I could type openid.stackexchange.com into the browser's URL bar, and follow the "logout" link to this page. But that's totally a hidden feature, and I don't think there's any way for an average user to figure it out without trawling through old meta posts.

Please add some way to get from the logout page to https://openid.stackexchange.com/, e.g. by making the underlined text in the screenshot above a link. Or provide some other way for people using Stack Exchange OpenID to log out properly, e.g. by making the logout form also log you out from the SE OpenID provider, if you're using it.

(See also: A related general feature request that I made two years ago, that led to the current footnote being added to the logout page — but, alas, without the link. Note that the logout interface has otherwise changed substantially since that request was made, so some parts of it may no longer be relevant. In any case, this request is a more specific one, and hence IMO worth making separately.)

Improve this question
6
  • I just noticed that an essentially identical feature-request -- perhaps a little less clearly written, with less fancy formatting and hand-drawn arrows -- was made on December 3 by BillR, but it seems to have totally slipped through the cracks (no votes, two comments). Not sure which one to close as a duplicate here.
    – Ilmari Karonen
    Commented Dec 27, 2015 at 23:28
  • 1. Yes, Ilmari Karonen, a very similar suggestion. I actually expected someone to find an earlier link I missed or inadequately reviewed asking for the same change. "Good on you" for getting the attention if it leads to a general fix. 2. Please emphasize that this issue goes beyond just Stack Exchange OpenID to any provider. A SE limited solution (link) by itself is almost worse since it hides the hanging permission even more. Not all of us want to be logged in -- and tracked -- all the time. Moreover, I segregate my hobby identity from my personal/family and my professional identities.
    – BillR
    Commented Jan 1, 2016 at 13:34
  • 3. I think the login page for Stack Exchange is also part of the problem. Compare it with the one for SuperUser or Information Security for example.
    – BillR
    Commented Jan 1, 2016 at 13:47
  • This is a surprising security lapse for such a large respected site. I have been using this site for years and this is the first time I have realised that "log out" hasn't been logging me out. The text at the bottom is small and highly confusing to the average user. I consider myself computer literate and when I read "Remember to log out of [...] Stack Exchange [...] as well", my mind doesn't register it as that appears to be exactly what I've done when I clicked StackExchange > Log Out. Furthermore, I had no idea how to actually do this until I Googled and found this page.
    – JBentley
    Commented Aug 25, 2016 at 13:57
  • @JBentley: It's worth noting that, apparently, SE's own OpenID server is now a bit more tightly coupled to the rest of their login system than it was when I wrote this request. It seems they've effectively moved the OpenID authentication process server-side, meaning that if you use SE's own integrated login form, and if you haven't separately used your SE OpenID account to log into SEDE or some other site that still uses the normal client-side OpenID mechanism, then I think that using the normal "log out" link in fact does log you out fully. It's still kind of a confusing setup, though.
    – Ilmari Karonen
    Commented Aug 25, 2016 at 14:40
  • Indeed, this is confusing. I tried it today after changing the password and was surprised it didn't ask for the new password when logging in again (after logging out on all devices).
    – This_is_NOT_a_forum
    Commented Jan 3, 2018 at 13:50

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .