I wonder which is the best practice in terms of security. Assuming an application where one can login from multiple devices in parallel what I should expect from "logout" button? To logout the user closing all the active sessions or to logout the current device only? I'm trying to figure out an attack in which the attacker takes over a device, change the credentials and then kicks out the legit user. If the logout disconnects all the sessions the legit user has no chances to recover, while if the logout is limited to one device this effect is somehow mitigated.