Sometimes I log out of a web page or app by clicking on a specific "logout" link. Other times I may be in a rush so I just close the browser. Is there a benefit to formally logging out? Is shutting down the browser less secure?
-
1Thank you everyone for your answers. I figured as much, but wanted some input from web developers that would know more details.– Bernard DyCommented Jan 26, 2012 at 1:06
Add a comment
|
4 Answers
There's too much variation in how web apps implement user authentication to answer this. Some will delete the cookies they've created; some will destroy the "session" variables that are associated with your account and your current browsing...session; others will just redirect you to a login page.
When I build web apps with user authentication, the user is generally associated with a session cookie, i.e., a cookie that isn't written to disk but which goes away when the browser is closed. So, in this case, clicking a "logout" link and closing the browser does essentially the same thing.
That said, it's possible on some web apps that your login is associated with a persistent cookie, or your IP address, or whatever, and just closing the browser won't log you out. In such a case it's conceivable that someone could come along after you, re-open the browser, and be logged in as you.
All that said, I'd say that it's good practice to log out of a web app, but if you forget it's not really a big deal.
-
Any site that 'just redirects you to the login page' is quite broken. It needs to log you out, so that someone who has access to your browser can't access your account. (Think, e.g., if you hit logout on a shared computer; the next user can't be allowed access to your account)– derobertCommented Jan 24, 2012 at 21:24
-
3I don't disagree, but not everyone builds their webapps "properly".– aleCommented Jan 25, 2012 at 2:11
Some websites don't log you off unless you click "Log Out". Even if you restart your computer, those sites could keep you logged in (unless the cookies are automatically removed by your web browser); so anyone who opens that site on your computer could be logged in as you. I've experienced this with many websites.
Hence, I recommend you always clicking "Log Out" before you shut down your computer. Another solution is to set your web browser to remove individual cookies on exit.
answered Jan 24, 2012 at 7:46
As an additional observation to the other answers, always use the site's log out function when you are not on your computer. Always!
Because:
...it's possible on some web apps that your login is associated with a persistent cookie, or your IP address, or whatever, and just closing the browser won't log you out. In such a case it's conceivable that someone could come along after you, re-open the browser, and be logged in as you.
Mos of websites store cookie at authenticated user's computer. Flash shared object can also be used for this but it is rather an exclusion. Server-side session management can be implemented in addition, but it is still based on saved cookie information.
So you can easily log off from 99.9% of websites by simply erasing their domain cookie, session cookie and path cookies.
If you're using Firefox (or Chrome), you can enable "safe browsing" mode, where your auth info is erased once the browser is closed. This is possible with other browsers as well; just take a look at the browser's preferences. At screenshot you can see FF web developer toolbar extension which lets you easily erase all types of cookies. There are specific simper cookie-related extensions for FF.
