Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Sometimes I log out of a web page or app by clicking on a specific "logout" link. Other times I may be in a rush so I just close the browser. Is there a benefit to formally logging out? Is shutting down the browser less secure?

share|improve this question
1  
Thank you everyone for your answers. I figured as much, but wanted some input from web developers that would know more details. –  Bernard Dy Jan 26 '12 at 1:06

4 Answers 4

up vote 10 down vote accepted

There's too much variation in how web apps implement user authentication to answer this. Some will delete the cookies they've created; some will destroy the "session" variables that are associated with your account and your current browsing...session; others will just redirect you to a login page.

When I build web apps with user authentication, the user is generally associated with a session cookie, i.e., a cookie that isn't written to disk but which goes away when the browser is closed. So, in this case, clicking a "logout" link and closing the browser does essentially the same thing.

That said, it's possible on some web apps that your login is associated with a persistent cookie, or your IP address, or whatever, and just closing the browser won't log you out. In such a case it's conceivable that someone could come along after you, re-open the browser, and be logged in as you.

All that said, I'd say that it's good practice to log out of a web app, but if you forget it's not really a big deal.

share|improve this answer
    
Any site that 'just redirects you to the login page' is quite broken. It needs to log you out, so that someone who has access to your browser can't access your account. (Think, e.g., if you hit logout on a shared computer; the next user can't be allowed access to your account) –  derobert Jan 24 '12 at 21:24
3  
I don't disagree, but not everyone builds their webapps "properly". –  Al E. Jan 25 '12 at 2:11

Some websites don't log you off unless you click "Log Out". Even if you restart your computer, those sites could keep you logged in (unless the cookies are automatically removed by your web browser); so anyone who opens that site on your computer could be logged in as you. I've experienced this with many websites.

Hence, I recommend you always clicking "Log Out" before you shut down your computer. Another solution is to set your web browser to remove individual cookies on exit.

share|improve this answer

As an additional observation to the other answers, always use the site's log out function when you are not on your computer. Always!

Because:

...it's possible on some web apps that your login is associated with a persistent cookie, or your IP address, or whatever, and just closing the browser won't log you out. In such a case it's conceivable that someone could come along after you, re-open the browser, and be logged in as you.

share|improve this answer

Mos of websites store cookie at authenticated user's computer. Flash shared object can also be used for this but it is rather an exclusion. Server-side session management can be implemented in addition, but it is still based on saved cookie information.

So you can easily log off from 99.9% of websites by simply erasing their domain cookie, session cookie and path cookies.

If you're using Firefox (or Chrome), you can enable "safe browsing" mode, where your auth info is erased once the browser is closed. This is possible with other browsers as well; just take a look at the browser's preferences. At screenshot you can see FF web developer toolbar extension which lets you easily erase all types of cookies. There are specific simper cookie-related extensions for FF.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.