Last modified: 2014-02-20 00:32:31 UTC
In facebook ( https://www.facebook.com/settings?tab=security ), one can selectively log ones self out of other current sessions, but in Mediawiki, one is helpless if one wants to log out of a session for which one no longer has access to the terminal of. Please implement being able to log out of selected other sessions, or at least a way of logging out of everything everywhere, short of changing ones password.
Logging out already logs you out of all your sessions.
I mean lets say I have nine sessions, eight on various computers around my house and at the lab, and one back at Bob's friend's house. I want to just terminate the latter, because there are lots of weird people at his house and I'm not going back there this week. Why should I have to hurt all my other sessions just to zap that one like I can already do in Facebook?
I believe this is the purpose of [[mw:Extension:SecureSessions]].
[[mw:Extension:SecureSessions]] only allows you to log out all sessions at once, not individual sessions.
(In reply to comment #4) > [[mw:Extension:SecureSessions]] only allows you to log out all sessions at > once, not individual sessions. Hmmm, interesting. So could this be a feature request for that extension, then?
What if the ability to logout itself was left to an extension? Then only users of the 1% of the wikis where the administrator had the grace to install such extension could log out. In this case we are forced to leave a hanging session available at Bob's house for anyone who would like to use it. Therefore we see that such basic security should not be left for extensions, and thus belongs in the core.
What wiki users want is not a factor in determining what features are included in MediaWiki core. If only 1% of sysadmins install the extension on their wiki, it's not MediaWiki's responsibility to correct the others. In fact, it's better if sysadmins have the choice of what they want to provide to their users In addition, there is very little reason to have a selective logout feature. Managing sessions is usually done for security purposes, i.e., if you left your account logged in somewhere and you're worried somebody might use it. In these cases it is safer to just reset all sessions.
