Meta Stack Exchange is a question and answer site for meta-discussion of the Stack Exchange family of Q&A websites. It only takes a minute to sign up.
Sign up to join this community
I recently discovered that I don't need to enter my password to log into Serverfault after successfully logging out. I'm not sure this is as secure as intended.
Steps to repeat (using Firefox 25.0.1) - Log in using stackexchange credentials - Log out - Log in using the stackexchange button without credentials - Successfully logged in without typing anything...
Is this just me?
Like Martijn mentioned in his comment, you must have not logged out of your OpenID provider (StackExchange, Google, etc.). Thus, when you logout from ServerFault, it's just ServerFault that you logout from. Meaning, when you try to re-login using StackExchange credentials, the cookies (session login data) on your OpenId provider site are retrieved by the OpenId provider to which you have granted authority to log you into ServerFault.
