Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out."

When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as someone else? I'd like to believe people log out on shared computers, where the shared computers themselves would usually not store cookies etc.

  • The only case I can think of is when the same user is logged in from several different IPs
    – superM
    Jul 20, 2012 at 10:23
  • Doesn't make much sense to me. If my system decides that somebody is logged in in any way he shouldn't, I would do logout immediately from server side and redirect either to home page or login page. Jul 20, 2012 at 10:37
  • I swear I've seen some app do this like once. I don't think it's necessary in almost any app though. When would you show this message and why?
    – Ben Brocka
    Jul 20, 2012 at 12:33

4 Answers 4


I don't think you're approaching this from the right angle. You've seen a feature, and you're searching for a problem to solve with it. That's backwards; add features to solve problems, not the other way around.

A big red flag is that the only company I see doing this is Amazon. Amazon is a prime example of a company not to copy from. See also 10 reasons not to copy from Amazon. Amazon is huge, Amazon has extremely specific sticking points they've identified from years of use. Amazon also has a lot of non-web design reasons people use the site, so you can't assume their UI should be copied at all.

For the record, this is the only place I see such a pattern used:

enter image description here

On dozens of other pages on Amazon I couldn't find this. It is only placed on the personalized recommendations page for me. It is also in a non-prominent place. All it's really doing is giving a convenient "log out" button in case I get a recommendation page and I get my wife/daughters' etc recommendation page.

This is not a UI element that is on every page. It is not in the header. It is hidden on specific, personal pages for a service that assumes your identity without verifying it; Amazon leaves you "soft" logged in to allow you to view your recommendations/track usage when you're not signed in with a password. In this state if you try to buy anything you'll have to be logged in.

This weird sort-of-logged-in state is specific to Amazon's problems; it keeps you logged in sort of by assuming your identity, but requires real authentication to do things. It is not a common state so it causes some unique usability issues that the large majority of apps do not have. This is why there's many more opportunities to log out in Amazon.

However note that even with this weird state, the "if you aren't X, log out" message is still uncommon. There's no need to assume the user has screwed up unless your data shows that a large percentage of your users are logged in as the wrong user at any given time; and if that's the case you've got serious problems well beyond what this feature would solve.

Once again you should be looking for solutions to problems rather than looking for problems for your solutions. If your site doesn't have a relevant problem, don't even begin to consider adding such a "solution".

  • To clarify - it's there, but hurts my eyes. I'm trying to decide if I'm wrong, or I should let higher ranks know it should go.
    – JNF
    Jul 22, 2012 at 6:01

For every website that logs in automatically, this can happen. In any household, even in companies, different people share the same PC and the same login in the operating system. This is bad practice, I know, but it's reality.

Users do not understand that by logging in on the OS as user X, they will also be logged in on facebook as user X by default. They just type "facebook.com" on someone else's PC and expect their own page. As soon as they realize it's not their page, they just want to get out of there. for an average user, a cookie is something to stuff into your mouth. Why do you think Google Chrome has an option to create browser profiles?

In other words: it's not intentional.

Showing a link "You are logged in as [user name]. Not [user name]?" is imo a very good way to cope with this situation. It is much more clear than a simple "logout". It makes it more visible that by proceeding you are in fact using someone else's credentials and offers an easy way out of that situation.

  • As I mention here it's extremely rare for this to actually be relevant. It's good to make loging out easy, but the large majority of interfaces have no need for a persistent question asking you if you really are who you're logged in as.
    – Ben Brocka
    Jul 20, 2012 at 16:04
  • Thank you. To emphasize the question: I am [username], how can I get you to quit nudging me?
    – JNF
    Jul 22, 2012 at 7:18

When is it right? Never. The answer to your question is contained within it:

"assuming someone is mistakenly logged in as someone else"

Your program can't be smarter than the user. I may have logged in as JNF because she called me and needed me to do something that could only be done on her account and has left her login active at her desk and is being held hostage at a remote location. Sure, this scenario is unlikely, but there are 10'000 others that you haven't thought of and your program can't know, it can only guess.

Better is a message:

You are logged in as JNF, please log out if you are not JNF.

No one gets accused, and more importantly, no one thinks your software is making incorrect assumptions or trying to thwart their legitimate effort to save JNF from her kidnappers.

  • Giving your credentials to somebody else is a really, really bad idea in a first place, so no, you don't have to be logged in as JNF. If in an application, the only way to do something is to logon as somebody else, this is the most important issue to solve. Jul 20, 2012 at 11:26
  • 2
    Amazon has "Hello <Name>. We have recommendations for you. (Not <Name>?)" where "Not <Name>" is a the logout link.
    – ChrisF
    Jul 20, 2012 at 11:31
  • 2
    @MainMa of course it's a bad idea, so is giving you the keys to my house/car/kid, etc. However, it would be irritating if the world prevented me from doing so based on its assumption that I ought not, especially if its assumption was wrong.
    – msw
    Jul 20, 2012 at 11:39
  • @ChrisF Amazon is a special case...they show that crap to you with a persistant cookie that lasts beyond your active session. So you're in a state where Amazon thinks you're X, but you aren't actively authenticated as X. I've never seen another site that does this. Actually I can't get amazon to show me that message anymore; has the site redesign nixed that?
    – Ben Brocka
    Jul 20, 2012 at 16:03

I would say if there are enough doubts that the current user is the logged in user to necessitate the presence of a link of this sort any user-related information accessible should be of the lowest-security type. I know eBay and amazon both have links like this, however I know that both hide private and or sensitive information from the user (current user) without first entering the password of the assumed logged in user.

If you're using it to show products based on previous searches then fine, if you're assuming a user is the same person and allowing access to private settings you may want to re-consider how the sessions are held. Letting the current user know they're logged in as another user may increase the amount of mis-use when compared to if that user (current) was logged in as another but didn't know. There are a lot of trolls out there!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.