1

This question already has an answer here:

I had checked youtube.com and stackoverflow.com. And found both of them can not log out if the network is unreachable.

I think this is a security risk, right?

Please image a situation below:

I visited this website on my friend's computer. And before I leave, I clicked the logout button but the network is down in that time. So I go home and thinking that I had logged out to succeed. But on another day, my friend opens his computer to start to visit stackoverflow and found my account still there.

marked as duplicate by multithr3at3d, Xander, MechMK1, Benoit Esnard, A. Hersean Aug 12 at 14:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 6
    I am a bit confused by your question. Why would you think that any website would be able to actively log off a user, if there is no network between your computer and the site? How would that be possible? – Ljm Dullaart Aug 7 at 9:14
  • If I can't log off when the network is unreachable for a few minutes before I leave that compute. the bad-guys may be using that compute to do everything on that website under my account. – 欧阳维杰 Aug 7 at 10:07
  • 2
    In the future, I highly advise you to use private browsing (also called incognito mode on some browsers). Private Browsing does not store any cookies permanently, and deletes them all when the window is closed. This will prevent future scenarios like this – MechMK1 Aug 7 at 10:45
  • 3
    If you do not trust a computer you are using, you should not be using it to log into any accounts. Worse things could be happening than just keeping you logged in. If the sole concern is logging out of a specific browser instance, you can clear the cookies for that site and hope they weren't copied maliciously. – multithr3at3d Aug 7 at 21:57
  • What I am worried about is that people may have not enough knowledge to understand they had remained their credential cookies on the computer after they clicked the logout button when the network is not working. There is no warning message at all. @multithr3at3d – 欧阳维杰 Aug 8 at 2:15
2

If a server has no connection with your client system, your command to log off can never reach the server.

Most web services use cookies to determine who is logged in. If you need to terminate the session, then you could throw away the cookies. A website may offer to delete cookies with javascript, see https://stackoverflow.com/questions/2144386/how-to-delete-a-cookie, but that can only be done locally.

Note that for example banks also have a time-out on the session, which means that if your session was inactive for a few minutes, the session will automatically be terminated.

It depends on a risk analysis to determine whether such a time-out is required. For banks, health-service etc, the answer is yes, its is required. Apparently, SO finds long logins not such a great risk and long logins are easier on the users, so no real time-out seems applied here.

  • As a user, I might not have the knowledge to keep my account save after I think I had logged off. And also, I might not have the knowledge to clear the session without an apparent button after I logged out failed. So I think this is the responsibility of the website to fix that exception. – 欧阳维杰 Aug 7 at 10:40
  • 1
    Once again: it is technically impossible for a website to receive the logoff-command if there is no network connection. SO is not clairvoyant. – Ljm Dullaart Aug 7 at 11:49
  • Technically, there are serval ways to achieve that which can make sure users can not access the website again even if the network is unreachable. see the discussion here. – 欧阳维杰 Aug 7 at 11:54
  • 1
    You should read that discussion probably a bit more careful. Technically, users can never access the website if the network is unreachable. – Ljm Dullaart Aug 7 at 12:02
  • of course, we can not access any website when the network is not working. But the method described there as far as I can understanding can make the logout operation valid even the network is not reachable currently. – 欧阳维杰 Aug 7 at 12:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.