6

The "log out" functionality of Stack Exchange appears to be broken. You can reproduce this with the following steps:

Logging in:

  1. Click "log in" on the top bar
  2. Click "log in with Stack Exchange"
  3. Enter your username and password, then click "Sign in"

Logging out:1

  1. Click the drop down menu at the top, then click "log out"
  2. Check "log out on all devices" and click "Log Out"

Logging in again:

  1. Click "log in" on the top bar
  2. Click "log in with Stack Exchange"

When logging in the second time, you will not be prompted for a username or password. This means that you were never actually logged out. You can even close and reopen the browser in-between steps 5 and 6 and get the same result.

Obviously this is a security concern for users who log in on public machines.

The only solution I am aware of at the moment is to clear the cookies after logging out.

This question has been asked before ([1] [2]). It seems that the usual recommendation is to log out of your OpenID provider — but in my case, I'm logging in with Stack Exchange (rather than Facebook, Google, etc), and I can't find another log out link.

1 These are the same instructions detailed here

Improve this question
1
  • 3
    You can check out any time you like, ..but you can never leave! mwahahaha – Mathieu Guindon Nov 28 '16 at 19:43
7

You're confused how logging out actually works when you've authenticated with an OpenID provider. Logging out on our site just clears your session on our site. You still need to go to the OpenID provider and either log out there or remove Stack's access to the account. If you use a Stack Exchange OpenID for login, you need to go to http://openid.stackexchange.com and make sure you are logged out there too. Otherwise, when attempting to "log in" again, we're really just sending you there to authenticate (or Google, or Facebook, whatever) - but you're still logged in there, and that account is already authorized to be used with our site, so it just sends you straight back and you're logged in.

Our OpenID service can be used anywhere on the Internet as a provider. Just because we operate it doesn't mean that if you log out on one of the sites we should automatically log you out of OpenID as well and thus force you to log into it again if you want to access a service somewhere else across the web.

Improve this answer
1
  • 1
    Thank you. But if that is the case, then I believe this should be clearly explained to the user, and a link should be provided to optionally log out of the StackExchange OpenID provider, because this is very counterintuitive. I think most people will expect that when they click "log out" that they will be completely logged out. – user1354557 Nov 28 '16 at 19:44
1

When you use the "Log in with Stack Exchange" option, you're using a two-step process that only partially involves the Stack Exchange sites.

You're actually signing in using Stack Exchange OpenID. Your username and password are verified there, and then the Stack Exchange site uses the OpenID service to authenticate you with the site.

To log out properly, you must log out of Stack Exchange OpenID as well as the sites.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .