2

Facebook and other apps allow you to log out without an active internet connection. We have to make the decision to allow this or not, but I think that you should ask for an internet connection to log out. This is mostly because the server could unregister your device for push notifications, although the token has an expiration.

What is the best approach to this?

Improve this question
1
  • 1
    Have you considered allowing the user to press a "Log Out" button without an internet connection and have it send a "log out" notice to your server once internet access is regained? This would allow for the benefits you cite (unregistering for push notifications, etc) while not forcing the user to wait and remember to log out later.
    – thunderblaster
    Apr 27, 2017 at 2:06

4 Answers 4

Reset to default
7

EDIT (09/12/2020): You can alternatively give the user a list of devices that they are logged into and give them the ability to log out of the device. You can set the first device that a user logs into as the "main" device and allow said device to augment which devices a user can log into. Whatsapp does this with their WhatsApp web client by allowing you to log out of certain device browsers that you previously logged into. Could be a good alternative to offline signout, but I don't know what happens now when you "main" device is offline 😂😂.

The answer here is definitely yes. For example, if I log into a friends computer (not using an incognito window of course. Many people don't even know incognito tabs exist) and I run out of internet, because I'm using metered internet, then I wouldn't be able to log out until the next time I use my friends computer.

Now we can all imagine what our 'friend' will end could end up doing, no? Anyway, it is then a very good idea to setup a method for users to log out even when there isn't internet. To avoid unwanted posts and/or drama.

Improve this answer
5
  • I agree with you, but your case is very particular for a computer as a client; one of the main reason why am I asking this question is because of push notifications in mobile, maybe with sensitive information.
    – rhdez.g
    May 5, 2017 at 19:16
  • @rhdez.g What type of sensitive info. Also, isn't having the notifications turned off a good thing. Since the user has already logged out.
    – Kitanga Nday
    Nov 26, 2017 at 12:42
  • When you hit "logout" on a website while not having a connection, you are just asking the local software, browser, OS to "forget" your session token rendering it unable to continue that session. You haven't actually ended the session in the backend system. So here there is perceived "logout" functionality but it isn't accurate, the reality is more nuanced.
    – straya
    Dec 7, 2020 at 23:30
  • @straya I think this answer could have been written better. What I was trying to say is that if one runs out of internet data whilst using a service on a device that isn't their own, they should be allowed to log out even though there isn't any internet. I mean I run out of data frequently. Now imagine someone logs onto FB using my device and data runs out as they are using browsing FB. It would be great if they could just tap logout and move on with life. This is all I wanted to say, unfortunately, what I wrote didn't reflect this well enough.
    – Kitanga Nday
    Dec 9, 2020 at 19:23
  • If UserA logs into UserB's mobile device, on UserB's account (i.e. no guest account, no multi-accounts, etc), both UserA and UserB did something stupid. No competently run business would allow that (policies prevent such stupidity, like sharing your password with someone). UserA invited problem scenarios such as the one you raised, UserA may get associated with UserB by authorities and for legal reasons, should UserA post offensive content SIM-level authentication may see UserB treated as the offender. User education is necessary here: don't share your mobile under your own account.
    – straya
    Dec 10, 2020 at 6:49
3

This actually depends. Given that on the web, an active Internet Connection is required. Meaning, that if you try to invoke: /logout or /exit.php, or any of website resource, you'll end up with a "Server not found" message or on mobile you might see a "No Internet Connection" message. This means that the file e.g. a logout.php cannot be accessed, leaving you still logged-in, because the PHP (or any back-end responsible code) cannot execute and make sure the user gets logged out. If this is solely a app for mobile, then internal code executing mobile-side will take care of the logout, eventually, the real-time API on the webserver, will discover that communication has died between this user and the platform, and eventually kill the session.

See this as well: Logging out of mobile app without Internet connection

TO add more, some services and platforms, e.g. Spotify work offline (airplane mode), meaning, you can logout or login and play your favorite music and songs from your personal lists. Once online, the app reconnects and checks for any updates or anything that might be useful.

Improve this answer
2
  • So how does Facebook app in iOS for allow log out without internet connection and when internet connection backs again, you won't receive push notifications in that device.
    – rhdez.g
    May 5, 2017 at 19:19
  • ^ Ask Facebook? BTW they update their code often, so how it works can change overnight. I would take a guess that they make sure that the logout request gets through the next time possible while enacting a superficial client-side logout in the meantime. They may also route all push-notifications through their client-side code, making it possible to omit the display of push-notifications under certain conditions.
    – straya
    Dec 7, 2020 at 23:52
0

For security and privacy reasons. Yes, they should be.

Improve this answer
-1

You need to identify risks and base your approach around that, the advice you'll get from a UX forum will typically lack acknowledgement of some of the internal workings and edge-cases (superficial, if you like).

I assume you are talking mobile, since you mention push-notification device registration.

Why are you providing a sign-out feature to the User? (please answer that, I am always interested to know exactly why)

If receipt of push-notifications after an attempted logout continues, and those contain private or sensitive information = a risk!

If a phone is sold or loaned after an attempted logout that sees another person able to subsequently take control of the account = a risk! Really, everyone should be factory-resetting before selling, so user education is the way to tackle that (as is done with Phishing). Also Apple and Google provide Lost Phone features, those exist to mitigate against the stolen/lost phone scenario and do it a lot better than expecting the user to pre-empt the unfortunate situation by aggressively logging out of your system.

My advice is, careful consider your rationale for providing a sign-out feature in the first place, if you decide it is important then make sure it works. That means retrying when a user attempts it but it fails, local Notifications can inform the User of the problem but the system shouldn't leave it up to the user to manage the problem (why write software and read UX forums if you can't auto-retry on behalf of the user?)

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.