#3802 Add possibility to log out from Fedora OpenID
Closed: Fixed None Opened 10 years ago by nucleo.

= problem =
After I logged in with Fedora OpenID and logged out on fedorahosted.org I can do next login without entering password.

= analysis =
Fedora OpenID logs out only after 15 minutes not using its account.
It is possible to log out manually by opening link https://id.fedoraproject.org/logout/ but this link not shown anywhere.

= enhancement recommendation =
Add link to https://id.fedoraproject.org/logout/ on https://id.fedoraproject.org/ and maybe this page should be shown after Logout pressed on fedorahosted.org to complete logout also on OpenID.


I will look into this soon.

This has been reported as github issue #22: https://github.com/fedora-infra/fas-openid/issues/22

I have thought about doing this, and will paste the same answer here.
Feel free to answer if you think you have some insights I have forgotten:

This will not be going to work: if we add a logout button to the homepage, people will expect to be logged out everywhere they used it upon clicking it, which is just plainly impossible because of the distributed nature.

This would require the OpenID provider to store a list of all sessions it has authenticated the user for (which would also need to be in an extension as that information is not provided in the original specification).
Also, this gives a lot of responsibility to the OpenID provider (logging the user out from all of the other services he/she has logged in to).

External OpenID relying parties will not support this extension though, and thus will not work with this, which will confuse the user: "Why am I logged out to these services, but not these?", while now they know exactly what to expect: "when I log out from one service, I only log out from that single service".

Yes, there is a "hidden" logout URL in FAS-OpenID, but that's hidden because most users will not be aware of these caveats and will probably see that confusion as a bug instead of the current behavior.

So sorry for the harsh answer, but I am marking this "wontfix" for now, until someone can explain to me how this would be possible to implement without confusion our users or limiting the number of websites that can use our OpenID provider.

Login to comment on this ticket.

Metadata