8

Possible Duplicate:
Why am I stilled logged into Gmail *AND* StackOverflow after logging out of StackOverflow?

Below is a scenario that can be seen like a small security issue:

  1. I open a new browser window and clear all my cookies

  2. I login to Stack Exchange using my Facebook or Google account.

  3. I sign out from Stack Exchange.

  4. I open Facebook or GMail in a new tab and I can see my Facebook account or my Gmail inbox.

Imagine that steps 1 to 3 happen in an Internet Cafe to user A. Afterwards, user A leaves the terminal and user B comes and performs step 4. User B will have a nice surprise :)

As I see here on Facebook Platform Policies page:

"Your website must offer an explicit "Log Out" option that also logs the user out of Facebook."

which Stack Exchange does not respect.

I am working at a similar integration (login with various identity providers) on a large site and I was wondering why you went this path (of not signing out the user from Facebook or Google as well) and not the other (performing a programmatic Sign Out to the above identity providers when signing out from Stack Exchange).

There is as well the third alternative of just specifying the Sign Out link for Facebook etc. next to Stack Exchange own Sign Out.

Browse other questions tagged .