Is remembering and using user ID when logged out a bad thing?

Question

I'm developing a website for a group of people who play a game online. (It's for a mmorpg guild). I'm creating it all myself rather than using an existing system mostly to learn website skills as I'm a c++ programmer.

It has some features that people will need to log in to use such as messages, chat and so on. I will certainly require the user to be logged in to get any access to those.

It also has some functionality that need to know the user asking for the information but there are no security implications at all as the information is entirely public anyway for example displaying stats for how the player is doing in game. Anyone could go look them up elsewhere so I only need to know who to display them for, not to authenticate.

My intention is to keep the user in a cookie or something so at all times the website will know who is asking for the information even if they are not logged on. (For privacy reasons I'll let people turn this ability on and off - defaulting it to off)

My question is, is this a bad user experience? Will it lead to confusion amongst users? That the website already seems to know who the user is and some of it works. But other parts need the user to log on first even though to a user it might seem it already knew who they were.

Basically after thinking about this for a while, I no longer have any idea if this would seem confusing or not any more to some random user.

Answer 1

I will not talk about the security issue here.

If the user is explicitly asking the website to remember their username it is not bad UX, on the contrary it is good UX that the website is offering such a service. Since people use different IDs in different games and this feature saves them the trouble of remembering the ID all the time. They can associate their password with their visible ID and log in.

It is a standard practice in many online games and many websites provide the same feature.

Gmail login

Not embedding other images on purpose.

Facebook login (look at the top bar)

League of legends login screen

World of warcraft login screen

Answer 2

Keeping someone logged in should be under control of that someone. When I log out, I expect a site to forget that I was logged in. In other words, it is not bad UX to ask for consent. It is bad UX not to ask for consent.

Even with I have given explicit consent to keep me signed in, when I do log out, I expect to be logged out and cookies by which I am identified to be removed (unless it is only to remember the user name I used and I have given consent to remember my user name).

Please bear in mind that many computers are used by multiple individuals and keeping someone logged or even identified without their consent is not just a security risk, but a privacy issue as well.