Why does logging in to Stack Overflow keep me signed in to my Gmail email after logging out and regardless of the Stay signed in checkbox?

Steps to reproduce:

  1. Browse to http://www.gmail.com and confirm you are logged out
  2. Browse to https://stackoverflow.com/ and confirm you are logged out
  3. Click login
  4. Click Google
  5. Enter Email/Password and confirm Stay signed in is unchecked
  6. Click Sign in
  7. Click logout (up top)
  8. Click Logout (down below)
  9. Browse to http://www.gmail.com and confirm you are still logged in
  10. Click Sign out <- Shouldn't clicking Logout on Stack Overflow be doing the same thing as this?
  11. Browse to http://www.gmail.com and confirm you are logged out

Answers are making sense but my frustration is that clicking Logout (twice) on StackOverflow essentially does nothing. If I proceed to click login and Gmail I am immediately authenticated because I still have an active Gmail cookie. In order to effectively logout I need to click Logout twice on Stack Overflow and then manually browse to http://www.gmail.com and Sign out.


It's due to the way OpenID works, and how Google uses its login system.

When you "login" to Stack Overflow, you are actually logging into your Google account, just as if you had logged in at gmail.com. Stack Overflow sends you to Google, lets you log in, and then Google sends a response back to Stack Overflow telling Stack Overflow that you're really an OK guy after all.

When you log out of Stack Overflow, you are ONLY discarding a cookie that Stack Overflow pays attention to. Stack Overflow does NOT send you to Google, not does it perform a logout from Google.

So when you go back to Google, you'll find you are still logged into Google - you never logged out of Google, you only logged in.

Stack Overflow does not, and cannot, log you out of Google.

If I proceed to click login and Gmail I am immediately authenticated

This is a feature of OpenID, and would be the same with all OpenID providers that allow single sign-on. They keep keys on your system so if another OpenID site requests verification, you don't have to provide your login credentials again.

In this way you can log in to OpenID once, then visit all your OpenID enabled sites throughout the day without having to login again, even though the sites know nothing about each other.

It's a primary feature of OpenID.

If it is a problem for you, you may be able to find a provider that allows you to disable this feature, or use your own (there are simple implementations you can use in a variety of languages and platforms).

  • 1
    Thanks for the clarification. My assumption was the the "logging in to Google" part was more of a true/false verification of the credentials passed and not a full login. Makes more sense now – Cory Charlton Mar 4 '10 at 5:25

I believe Gmail only erases the cookie once you shut down your browser.

Either way, this is not really a StackOverflow problem. This is an issue for the Gmail team.

The two cookie are completely different, and affect different sites.

StackOverflow can only control whether you are logged in or out of StackOverflow, and Gmail can only control whether you are logged in or out of Gmail. The two are only interconnected to provide verification that you are the person that controls that OpenID. After that confirmation is complete, the two have no correlation with each other.

You might want to familiarize yourself with how OpenID works and maybe cookies as well.

  • 1
    Lol thanks, pretty familiar with how cookies work and your OpenID link doesn't really explain why clicking logout doesn't actually log me out. – Cory Charlton Mar 4 '10 at 5:20
  • 4
    If you knew how cookies worked, and knew how OpenID worked, it would be pretty easy to figure out why SO can't get rid of your Gmail cookie... – Tyler Carter Mar 4 '10 at 5:32
  • 3
    Didn't say I understood the underlying workings of OpenID. My point was that your link says "OpenID allows you to use an existing account to sign in to multiple websites, without needing to create new passwords." and even if I dig a little further I don't run across anything that suggests that you are actually creating a session with the OpenId provider as opposed to the provider simply verfiying your credentials and giving a response to the consuming site. – Cory Charlton Mar 4 '10 at 14:17

Because the cookie is stored under stackoverflow.com domain, in your browser.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .