Why doesn't logging out of Stack Overflow log me out of Gmail?

Question

Why does logging in to Stack Overflow keep me signed in to my Gmail email after logging out and regardless of the Stay signed in checkbox?

Steps to reproduce:

1. Browse to http://www.gmail.com and confirm you are logged out
2. Browse to https://stackoverflow.com/ and confirm you are logged out
3. Click login
4. Click Google
5. Enter Email/Password and confirm Stay signed in is unchecked
6. Click Sign in
7. Click logout (up top)
8. Click Logout (down below)
9. Browse to http://www.gmail.com and confirm you are still logged in
10. Click Sign out <- Shouldn't clicking Logout on Stack Overflow be doing the same thing as this?
11. Browse to http://www.gmail.com and confirm you are logged out

---

Answers are making sense but my frustration is that clicking Logout (twice) on StackOverflow essentially does nothing. If I proceed to click login and Gmail I am immediately authenticated because I still have an active Gmail cookie. In order to effectively logout I need to click Logout twice on Stack Overflow and then manually browse to http://www.gmail.com and Sign out.

Answer 1

It's due to the way OpenID works, and how Google uses its login system.

When you "login" to Stack Overflow, you are actually logging into your Google account, just as if you had logged in at gmail.com. Stack Overflow sends you to Google, lets you log in, and then Google sends a response back to Stack Overflow telling Stack Overflow that you're really an OK guy after all.

When you log out of Stack Overflow, you are ONLY discarding a cookie that Stack Overflow pays attention to. Stack Overflow does NOT send you to Google, not does it perform a logout from Google.

So when you go back to Google, you'll find you are still logged into Google - you never logged out of Google, you only logged in.

Stack Overflow does not, and cannot, log you out of Google.

If I proceed to click login and Gmail I am immediately authenticated

This is a feature of OpenID, and would be the same with all OpenID providers that allow single sign-on. They keep keys on your system so if another OpenID site requests verification, you don't have to provide your login credentials again.

In this way you can log in to OpenID once, then visit all your OpenID enabled sites throughout the day without having to login again, even though the sites know nothing about each other.

It's a primary feature of OpenID.

If it is a problem for you, you may be able to find a provider that allows you to disable this feature, or use your own (there are simple implementations you can use in a variety of languages and platforms).

Answer 2

I believe Gmail only erases the cookie once you shut down your browser.

Either way, this is not really a StackOverflow problem. This is an issue for the Gmail team.

The two cookie are completely different, and affect different sites.

StackOverflow can only control whether you are logged in or out of StackOverflow, and Gmail can only control whether you are logged in or out of Gmail. The two are only interconnected to provide verification that you are the person that controls that OpenID. After that confirmation is complete, the two have no correlation with each other.

You might want to familiarize yourself with how OpenID works and maybe cookies as well.

Answer 3

Because the cookie is stored under stackoverflow.com domain, in your browser.