As designed Explicit log out on desktop but still logged in on laptop

[Sim]

Affected version

xenforo.com XF 2.3b2

Just wanted to try passkey login on my laptop, so I logged out of xenforo.com/community on my desktop and then fired up my laptop only to discover I'm still logged in there?

I would have thought that explicitly logging out of one device should log me out of all sessions? Seems like a security problem to me?

 

[Chris D]

This is highly debatable. I'm not disputing that a "Log out of all devices" option wouldn't be useful, but I don't think it's reasonable to expect that would be the default. I can't actually recall any web app or service I use frequently which does this (then again, I probably don't log out of things as often as I should).

Not a bug at this point but perhaps worth considering as a option for the future.

 

[Lee]

I agree. Default behaviour would be to logout that session, not ALL sessions. That is how most, if not ALL webapps I use operate.

 

[Mendalla]

Agree with the others. In my experience, log out all sessions is offered as an option by some sites when resetting your password. Never seen it used any other way.