Sign out functionality Options

[Christian J]

Any good ideas about (or links discussing) design practice for signing out from online applications?

Using nothing else than a sign out button, the user may forget to click it before leaving the page and remain signed in without anything reminding him about it.

With HTTP authentication or session cookies the user can sign out by closing the browser, but again the user may forget about it, or think that just closing a single browser tab is enough.

The javascript onUnload event might be used to sign out the user as soon as he leaves/closes the page, but only if JS (and AJAX?) is supported/enabled.

Signing out automatically after a certain time might be a useful enhancement to a sign out button, but how long should the timer wait? If the goal is to prevent others from using the same computer, just a minute after the legitimate user left the computer might be too long already.

[Darin McGrew]

It really depends on the application, and on the sensitivity of the data. I've used apps that sign me out after less than an hour of inactivity, but most online apps allow me to stay logged in for weeks at a time.