Handle logout failure

Question

I was wondering what is the best way to handle logout failure in website.

Like, I have a case where the server returned error when trying to verify user session. And in turn, this should force logout user. However, apparently there's a problem in the server, so when I call the logout API, it returned with error, making the process failed.

So, now the user session is in limbo. Since their session is invalid, they should not be able to access certain features (ie. user profile). But, on the other hand, the server cannot correctly logout the user (properly ending the session).

Of course, I could clear the local data (cache, local storage, etc) and that would at least treat them as non-login users in the site. The user won't notice that the logout failed or anything, they just think it's a success logout. But is that okay?

Answer 1

I'm currently using a service which apparently has issues with logging out, and they actually informed me of the logout failure, like it was as if I have not logged into the portal to begin with.

The message indirectly suggested the user to contact the administrator to share the error information with them.

As a user, I can't be bothered.

If logout failures can lead to potential data security issues, you should do something about it, but you should not expect users to work on it because to users (usually) logging out of an application just means that they're done using the software and there is no concern to do anything about it.

What you should do is:

1. Don't confuse the user with logout error messages - when I first saw it I thought I had missed out something or my data wasn't saved. When I re-logged in to check that everything looks fine, I simply ignore the message, it would not help the development team that there was some error on the program.
2. You can collect the data remotely/ automatically but inform the user before doing so.
3. Assure the user that their information is safe and that you are looking into the error, so that you would resolve the issues as soon as possible.

Although you can mask the logout error but I feel that doing the right thing is more important than making things look right when they are not.

Answer 2

Imagine if you were logged into your Facebook on a public computer, then logged out, but the logout failed because the server was busy. Facebook couldn't log you out but the website on the client side pretended that you were logged out. You leave. Someone else comes in and goes to Facebook. The server isn't busy anymore. Lo' and behold, because the log out didn't actually happen, they are now able to access your Facebook.

The best thing to do would be to concentrate on fixing the server issues so this doesn't happen (rather than concentrate on the UX part). But if something went wrong, don't lie to the user -- just tell give them a friendly error message, and some instructions to clear their cookies/close their browsers if they might be worried about their data. Most people won't care, but some might.