I had checked youtube.com and stackoverflow.com. And found both of them can not log out if the network is unreachable.

I think this is a security risk, right?

Please image a situation below:

I visited this website on my friend's computer. And before I leave, I clicked the logout button but the network is down in that time. So I go home and thinking that I had logged out to succeed. But on another day, my friend opens his computer to start to visit stackoverflow and found my account still there.

  • 6
    I am a bit confused by your question. Why would you think that any website would be able to actively log off a user, if there is no network between your computer and the site? How would that be possible? Aug 7, 2019 at 9:14
  • If I can't log off when the network is unreachable for a few minutes before I leave that compute. the bad-guys may be using that compute to do everything on that website under my account. Aug 7, 2019 at 10:07
  • 2
    In the future, I highly advise you to use private browsing (also called incognito mode on some browsers). Private Browsing does not store any cookies permanently, and deletes them all when the window is closed. This will prevent future scenarios like this
    – user163495
    Aug 7, 2019 at 10:45
  • 3
    If you do not trust a computer you are using, you should not be using it to log into any accounts. Worse things could be happening than just keeping you logged in. If the sole concern is logging out of a specific browser instance, you can clear the cookies for that site and hope they weren't copied maliciously. Aug 7, 2019 at 21:57
  • What I am worried about is that people may have not enough knowledge to understand they had remained their credential cookies on the computer after they clicked the logout button when the network is not working. There is no warning message at all. @multithr3at3d Aug 8, 2019 at 2:15

1 Answer 1


If a server has no connection with your client system, your command to log off can never reach the server.

Most web services use cookies to determine who is logged in. If you need to terminate the session, then you could throw away the cookies. A website may offer to delete cookies with javascript, see https://stackoverflow.com/questions/2144386/how-to-delete-a-cookie, but that can only be done locally.

Note that for example banks also have a time-out on the session, which means that if your session was inactive for a few minutes, the session will automatically be terminated.

It depends on a risk analysis to determine whether such a time-out is required. For banks, health-service etc, the answer is yes, its is required. Apparently, SO finds long logins not such a great risk and long logins are easier on the users, so no real time-out seems applied here.

  • As a user, I might not have the knowledge to keep my account save after I think I had logged off. And also, I might not have the knowledge to clear the session without an apparent button after I logged out failed. So I think this is the responsibility of the website to fix that exception. Aug 7, 2019 at 10:40
  • 1
    Once again: it is technically impossible for a website to receive the logoff-command if there is no network connection. SO is not clairvoyant. Aug 7, 2019 at 11:49
  • Technically, there are serval ways to achieve that which can make sure users can not access the website again even if the network is unreachable. see the discussion here. Aug 7, 2019 at 11:54
  • 1
    You should read that discussion probably a bit more careful. Technically, users can never access the website if the network is unreachable. Aug 7, 2019 at 12:02
  • of course, we can not access any website when the network is not working. But the method described there as far as I can understanding can make the logout operation valid even the network is not reachable currently. Aug 7, 2019 at 12:12

Not the answer you're looking for? Browse other questions tagged .