We are adding the ability for enterprises to configure login to our web application via external single-sign-on providers (initially via WS-FED, however, future versions will support additional protocols). Username/password authentication will also be available for customers that don't have/want to configure an external SSO provider, and also as a fall-back in cases where there is some problem with the SSO provider.

What should happen when users click the "Log out" button in our application?

  • They are logged out of our application only so that other applications that authenticate via the SSO provider are still available.
  • As above, but we additionally request re-authentication with the SSO provider.
  • They are completely logged out of their SSO provider

4 Answers 4


This is one of those places usability and security cause radically different answers.

From a usability standpoint I have observed the following arguments:

  • When I logout on Site a I only logout form here and I can keep on using the other locations I am still logged into.
  • When I press logout on Site a I actually only get redirected to Site b (the portal) and only when I log out form there I am actually logged out. (mostly used in the context of an intranet or similar environment)

From a security standpoint I have observed the following arguments:

  • When a user does a Logout, immediately invalidate ALL sessions for this user and log him/her/it out from any and all systems part of the SSO.
  • When a user does a logout, inform the SSO provider and do not allow any new sessions and logout of the current application. but there is no implicit logout to all systems in the SSO. (usually mitigated with short session times / cookie lifetimes). This can be a technical limitation due to the technologies involved (and/or licenses)
  • @NeilSmithline Thanks, I missed that when I did my re-read.
    – LvB
    Feb 29, 2016 at 15:28
  • 1
    Given that SSO login is transparent and implicit when a user is logged in "other locations" what is the meaning of "I only logout from here and I can keep on using the other locations" ? I question the "I only logout from here" part. If, after a few minutes, the user were to visit with his browser the location he just logged out from (while still being logged into some other locations) then he would automatically and transparently log in again without noticing anything. In such a scenario what is the meaning of "I only logout from here" in terms of user experience ? Nov 27, 2016 at 23:49
  • From a users standpoint t means the user feels like it can not trust the web applications. (a logout does not always mean I am logged out) I focus here on the security implications. and they are even worse than the user-experience. in the first example an attacker can obtain user access credentials (e.a. a session) when the user thinks he/she/it logged out. SSO is not an simple subject before you try and implement it learn and understand its implications.
    – LvB
    Dec 1, 2016 at 9:36

In most SSO authentication system I've used, Log Out usually means to log out of the authentication provider and all connected systems.

In some poorly written applications and SSO system, the application may cache the authentication and may not notice that the session they're using have already expired, but the application are supposed to periodically recheck the session validity to prevent this situation from staying for long. Better SSO systems are able to post back to the applications, to force them to log out immediately rather than depending on the application check periodically.

  • Do you have any documentation for "the application are supposed to periodically recheck*? In what scenarios using what standards? Feb 29, 2016 at 15:07
  • @NeilSmithline: I don't think there's a standard here. I've seen many different handling in the wild. While I say "periodically recheck", it's really implementation dependant how that's done, some applications may have short session time, others might do background runner, and some might just lazily revalidate on the next request from the user or depends on call back. No matter how the applications implement this, the goal is usually that single sign in implies single sign out.
    – Lie Ryan
    Feb 29, 2016 at 15:19

There's probably no right answer here, but I'll advocate that "Log Out" only applies to your site.

Stack Exchange as an example

I use the "Sign in with Google" option. When I click Log Out, I see this:

The logout "menu" in stack exchange


  1. It shows that I will be logged out of all Stack Exchange domains.
  2. It is my choice whether to only log me out of this device, or all devices. (which I assume is delete-local-browser-cache vs invalidate-serverside-session).
  3. After logging out of SE, my gmail tab continues to work.

Some reasons that I'm not comfortable with

They are completely logged out of their SSO provider


I'd be pretty annoyed if I log out of Stack Exchange on my laptop and some time later discover that my phone's been kicked out of my Google account, causing me to miss urgent emails, chats, have unsynced Google Docs, etc.


If logging out of one service causes me to be logged out of the SSO provider, could that be considered a denial of service attack vector? ie can a rogue Stack Exchange employee get my browser to log me out of all Google services? Does it increase the impact of XSS vulnerabilities in the 3rd party sites? ie does this in any way link the security of two unrelated sites just because they use the same SSO provider? (I'd need to ponder on this some more)

  • +1 Good points, but ie can a rogue Stack Exchange employee call Log Out on my account? Nope, because logout requires the cookies for the SSO domain (e.g. Google), which are stored on your device and cannot be accessed by another domain,
    – Justin
    Sep 12, 2018 at 16:22
  • I agree that they can't hijack your existing session with the SSO server, but what's stopping them from opening a new session? Basically, what's stopping an admin from writing a script that requests a login token from the SSO provider for your account, if you happen to be logged in using a different app then the script will be given a cookie, then it logs you out? (I'm probably missing some key piece of the SAML / OpenID Connect protocol) Sep 12, 2018 at 16:59

Questions like this arise when there's confusion about the purpose of "Log out" button.

What is "Log out" for?

Some preconditions:

  • Usability-wise, if the user does not want to log out, they should simply not use this button.
  • If the website providing the log out button cannot be trusted, what logging out actually does is moot.
  • "Log out" should not be confused with "Switch account". Even though "Switch account" can be emulated by logging out and logging in again, the usability of this use-case should not be priority in the design of "Log out" button. Usability issues that arise due to the lack of a "Switch account" button is exactly due to that lack of, and is no fault of what the "Log out" button does.

What is "Log out" for?

When the browser is used in a physically shared PC, the user needs some way clearing their sessions so that another user who uses the same PC afterwards cannot also gain access to the same sessions.

Hence, the "Log out" should:

  1. Invalidate the session on the website used
  2. Sign out of the SSO provider

If the implementation of the "Log out" button omits the second bullet, other users can simply SSO back into the website using the still active SSO provider session.

Note: "Sign out of the SSO provider" does not mean immediately logging out of every websites logged in using the same SSO provider. Each website will have their own independent session, so some sites may be accessible well after signing out of the SSO provider. Logging out of every website logged in using the same SSO provider is beyond the scope of a single website's "Log out" button.

  • "Sign out of the SSO provider" - So let's assume I login to FooBar with Google account. If I click Log Out button on FooBar I should be logged out of Google (my IdP) too? Maybe I should, but I won't be. In this case if I give my PC to another person and they click "Login with Google" on FooBar website again, they will use MY Google account, because I'm still authenticated there. Oct 3, 2020 at 13:51
  • @SylwesterKardziejonek Maybe I should, but I won't be: That's entirely dependent on FooBar. In practice you're right that there're many FooBars that don't sign you out of the IdP. Logout on those sites being mostly useless for security. StackExchange's solution is to take the middle ground with a message "remember to log out of your Open ID provider as well" on the logout page. Google's products such as YouTube are more rigorous and their logouts sign you out of Google.
    – antak
    Oct 3, 2020 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .