1

If a user is logged in to a website (via https), is there any reason to log out of the website when they are done using it?

For this question, please assume:

  • The network is reasonably secure (ex. not public WiFi)
  • The user has exclusive physical access to the computer and network hardware
7

HTTP is a stateless protocol. Being logged into a website means that a shared state need to be kept between client and server. This is usually accomplished using a shared session ID which is commonly stored on the clients side as a cookie and on the server side in a database. If the attacker can make use of this session ID he can do actions as the authorized user.

Cross Site Request Forgery (CSRF) is a common attack to misuse this cookie even though the attacker cannot read the cookie's value. This attack is for example used to hijack and reconfigure routers so that they can be used to man in the middle any connections to the internet.

Other attacks steal the session ID for example using Cross Site Scripting (XSS). Of course the session ID can also be stolen by hacking the server or its database for example using SQL injection or simply be guessing the correct session ID in case of easily predictable session ID's.

While all these attacks can be done when the user is logged in a properly implemented logout invalidates the session ID which then can no longer be misused. This way the attack surface is reduced.

1

Yes. If an attacker can obtain the user's session ID, he/she can impersonate the user. This can potentially be accomplished via an XSS attack, Session Fixation attack, or if the system produces predictable session tokens.

Also, it provides an additional layer of defense in the even that either of your assumptions are false.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.