1

This question already has an answer here:

When I click "log out" the site shows me as being logged out, but I can log back in again by just choosing "Google" option from the log in page.
I'm not taken to google.com to enter email/password again.

I've tested to repro, as below.

  • Before starting each test, I started with a clean browser - no cache, cookies, history - I wiped everything
  • "log out" was done by the drop down menu
  • OS: Debian 8
  • Browser: Iceweasel 31.8.0

TEST 1

  1. Clicked "log in" on MSE
  2. Redirected to MSE login page (3 options)
  3. Clicked "Google"
  4. Redirected to google.com (login form)
  5. Entered credentials, was redirected back to MSE (was logged in)
  6. Clicked "log out" on MSE
  7. Redirected to log out confirmation page (clicked "log out")
  8. Redirected back to main MSE page shown as being logged out
  9. Click "log in"
  10. Clicked "Google" on login page
  11. Am logged in

The problem

After logging out and the site showing me I am no longer logged in, then clicking "log in" I am not redirected to Google to enter my credentials (email/password), when I should be as I had previously clicked "log out" on Stack site.

This means if I click "log out", someone/anyone with access to my computer can click "log in" and then click "Google" and are logged in to my account.
I don't have this security issue personally, but many users might with shared devices, public computers, shared work PCs, etc.

Regardless of potential users this affects, I would have thought clicking "log out" would mean if I click "log in" on the same browser I would have to enter my credentials again with Google.


Other tests

TEST 2

The same happens on Stack Overflow following "TEST 1" exactly (so this not MSE specific).

TEST 3

It doesn't matter which site I log in and out of at all.
Once I've been logged in, after clicking "log out", I can click "log in" and choose "Google" and without having to enter my credentials I am logged in to all sites again.

Even if I log out on one site, go to a site I've not been to yet, and click "log in" there.


Other

I don't have a Facebook or Stack account, only log in through Google, so cannot confirm if this is specific to Google auth or not.


Cookies

(This is mostly info Stack will use if needed/if it helps).

Based on TEST 1.

Before starting TEST 1:

0 cookies.

After logging in to MSE first time:

All cookies have the same following info:

Host: .meta.stackexchange.com
Path: /
Expires: At end of session
Secure: No

Individual cookies (all contained the above info, but removed from below to shorten list; also removed "value" as it's pointless info):

Name: __cfduid
HttpOnly: Yes

Name: __qca
HttpOnly: No

Name: _ga
HttpOnly: No

Name: _gat
HttpOnly: No

Name: acct
HttpOnly: Yes

Name: prov
HttpOnly: Yes

After clicking "log out":

The same as above except cookie "acct" was no longer there, and an additional one only appeared after I'd clicked "log out":

Name: gauthed
Value: 1
Host: meta.stackexchange.com
Path: /
Expires At end of session
Secure: No
HttpOnly: No

When I log in again (having logged out but now without having to re-enter credentials to log in):

"gauthed" is gone and "acct" returns.

"acct" is a different value to what it was when I was initially logged in.

The cookie "values" when I was first logged in are the same as when I have clicked log out (except for "acct" as that has gone) and the same as when I log in the second time (except "acct" which changes).

marked as duplicate by Shog9 Jul 22 '15 at 2:01

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

Stack Exchange can't log you out of Google (nor can Google log you out of Stack Exchange) - you'll have to log out of both services individually.

Hence the reminder on the "log out" page: remember to log out of your Open ID provider (Facebook, Google, Stack Exchange, etc.) as well

  • You know, I re-read my question and thought, there's no way Stack has this "bug", I'm missing something. I forgot Google doesn't allow single logouts (though they should by now). Cheers – James Jul 22 '15 at 2:13

Not the answer you're looking for? Browse other questions tagged .