This question already has an answer here:
When I click "log out" the site shows me as being logged out, but I can log back in again by just choosing "Google" option from the log in page.
I'm not taken to google.com to enter email/password again.
I've tested to repro, as below.
- Before starting each test, I started with a clean browser - no cache, cookies, history - I wiped everything
- "log out" was done by the drop down menu
- OS: Debian 8
- Browser: Iceweasel 31.8.0
- Clicked "log in" on MSE
- Redirected to MSE login page (3 options)
- Clicked "Google"
- Redirected to google.com (login form)
- Entered credentials, was redirected back to MSE (was logged in)
- Clicked "log out" on MSE
- Redirected to log out confirmation page (clicked "log out")
- Redirected back to main MSE page shown as being logged out
- Click "log in"
- Clicked "Google" on login page
- Am logged in
After logging out and the site showing me I am no longer logged in, then clicking "log in" I am not redirected to Google to enter my credentials (email/password), when I should be as I had previously clicked "log out" on Stack site.
This means if I click "log out", someone/anyone with access to my computer can click "log in" and then click "Google" and are logged in to my account.
I don't have this security issue personally, but many users might with shared devices, public computers, shared work PCs, etc.
Regardless of potential users this affects, I would have thought clicking "log out" would mean if I click "log in" on the same browser I would have to enter my credentials again with Google.
The same happens on Stack Overflow following "TEST 1" exactly (so this not MSE specific).
It doesn't matter which site I log in and out of at all.
Once I've been logged in, after clicking "log out", I can click "log in" and choose "Google" and without having to enter my credentials I am logged in to all sites again.
Even if I log out on one site, go to a site I've not been to yet, and click "log in" there.
I don't have a Facebook or Stack account, only log in through Google, so cannot confirm if this is specific to Google auth or not.
(This is mostly info Stack will use if needed/if it helps).
Based on TEST 1.
Before starting TEST 1:
After logging in to MSE first time:
All cookies have the same following info:
Host: .meta.stackexchange.com Path: / Expires: At end of session Secure: No
Individual cookies (all contained the above info, but removed from below to shorten list; also removed "value" as it's pointless info):
Name: __cfduid HttpOnly: Yes Name: __qca HttpOnly: No Name: _ga HttpOnly: No Name: _gat HttpOnly: No Name: acct HttpOnly: Yes Name: prov HttpOnly: Yes
After clicking "log out":
The same as above except cookie "acct" was no longer there, and an additional one only appeared after I'd clicked "log out":
Name: gauthed Value: 1 Host: meta.stackexchange.com Path: / Expires At end of session Secure: No HttpOnly: No
When I log in again (having logged out but now without having to re-enter credentials to log in):
"gauthed" is gone and "acct" returns.
"acct" is a different value to what it was when I was initially logged in.
The cookie "values" when I was first logged in are the same as when I have clicked log out (except for "acct" as that has gone) and the same as when I log in the second time (except "acct" which changes).