Logout UI question for the community

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2016-11-30 22:15]:
> Is there any good reason for trying to report that to the user,
> vs. an overall "it all worked, or it all didn't work" result?

I guess there's not much to do for someone looking at the list of
services logout did not work for. You could visit each site and then
what? Maybe there's a logout link there that "works" (in killing at
least any local sessions), maybe that would just try to trigger SLO,
maybe there's not even a logout link there in the first place.

Personally I have the "Remove cookie(s) for site" extension on all my
browsers on all my devices (removes all cookies for the current FQDN
with one click -- saved me many weeks of time when testing SSO systems
over the years), so theoretically I could visit each of those sites,
hit the icon, and know all sessions here are killed, without removing
any other of my cookies I might like to keep. Repeat this process for
each site where SLO reportedly failed.
Yes, that's highly likely to becommon and even more likely to be an
acceptable user experience.

Of course I never log out from a web site (except for testing logout),
I lock my device. On someone else's computer I start private browsing
mode /before/ I ever log on (and usually I don't, you never know, key
loggers and all).

-peter