I’ve done a bit more testing to try and confirm some details. I’ve confirmed that the _forum_session cookie value is different for each separate login, so it doesn’t appear to be a problem with the same session id being used for each login. It looks like there are three different methods to logout (also shown in screenshot below).
-
Click your user profile icon in the upper right corner of the page and click Log Out. This logs you out of all sessions on all devices. I assume this should only log you out of the current session on the current device.
-
Click your user profile icon in the upper right corner of the page and click the Preferences gear. On the Preferences page, you can view Recently Used Devices. The devices you’re logged in on, other than the current device you’re using, have a wrench icon next to them. Clicking that wrench icon gives you a Log Out option. Clicking that Log Out option for a specific device just logs you out of that individual device but keeps you logged in on all other devices. This is as expected.
-
Click your user profile icon in the upper right corner of the page and click the Preferences gear. On the Preferences page, you can view Recently Used Devices. There’s a “Log out all” link at the bottom of the Recently Used Devices section. Clicking this “Log out all” links logs you out of all devices. This is as expected.
So logout methods 2 and 3 are functioning as I would expect. I would assume logout method 1 should only log you out of the current session on the current device, not log you out of all sessions on all devices. The use case for this is logging in on a personal phone that you trust and leave logged in, but then also logging in on a shared PC where you don’t want others accessing your account so you logout after you’re done. I would assume logging out of the shared PC would allow me to stay logged in on my personal phone. Is this the intended behavior?
I suppose a work-around for the use case above would be to access your account from the personal phone when you’re done using the shared PC and use logout method 2 to logout of the shared PC. This would work, it would just be a bit more awkward than logging out directly from the shared PC.
