What does logging out actually do?¶
id: "AI-024" title: "What does logging out actually do?" series: "Accounts and Identity" content_type: "video-script" status: "draft" owner: "IF Digital"
What does logging out actually do?¶
Script¶
A user presses “log out”.
What happens next depends on the service.
Logging out usually ends or invalidates the current session on that device or application.
It may remove a session cookie, revoke a token or tell the provider that the session should no longer be accepted.
But logging out of one session does not always log the user out everywhere.
The same account may remain active on another phone, browser, tablet or application.
Some services offer a separate option to log out of all devices.
Even that may not affect every linked service or third-party application immediately.
The browser may also retain other evidence after logout.
History, cached pages, saved usernames, downloaded files and account notifications may remain.
A password manager may still hold the credentials.
Another application may still have a valid token.
This matters when interpreting both user behaviour and device evidence.
The absence of an open account does not prove the device was never used.
The user may have logged out.
The presence of old account data does not prove the session was still active.
You need to establish what state existed at the relevant time.
Provider records may show session creation, logout or revocation events.
Device examination may show whether cookies or tokens remained.
Security emails may record that the account was signed out or that other sessions continued.
Also distinguish between closing an application and logging out.
Closing the browser window may leave the session valid.
Turning off the device may do the same.
When the user returns, the account may reopen without fresh authentication.
Logging out is therefore a session-management action.
It usually ends one route of access.
It does not necessarily remove all traces, end every session or prevent access through other trusted devices.
Always ask which session was ended, on which device, and whether any other access remained active.