Logging out already logs you out of all your sessions.

I mean lets say I have nine sessions, eight on various computers around my house and at the lab, and one back at Bob's friend's house. I want to just terminate the latter, because there are lots of weird people at his house and I'm not going back there this week. Why should I have to hurt all my other sessions just to zap that one like I can already do in Facebook?

I believe this is the purpose of [[mw:Extension:SecureSessions]].

[[mw:Extension:SecureSessions]] only allows you to log out all sessions at once, not individual sessions.

(In reply to comment #4)

[[mw:Extension:SecureSessions]] only allows you to log out all sessions at
once, not individual sessions.

Hmmm, interesting. So could this be a feature request for that extension, then?

What if the ability to logout itself was left to an extension?

Then only users of the 1% of the wikis where the administrator had the grace to install such extension could log out.

In this case we are forced to leave a hanging session available at Bob's house for anyone who would like to use it.

Therefore we see that such basic security should not be left for extensions, and thus belongs in the core.

What wiki users want is not a factor in determining what features are included in MediaWiki core. If only 1% of sysadmins install the extension on their wiki, it's not MediaWiki's responsibility to correct the others. In fact, it's better if sysadmins have the choice of what they want to provide to their users

In addition, there is very little reason to have a selective logout feature. Managing sessions is usually done for security purposes, i.e., if you left your account logged in somewhere and you're worried somebody might use it. In these cases it is safer to just reset all sessions.

In T58212#643013, @MZMcBride wrote:

[[mw:Extension:SecureSessions]] only allows you to log out all sessions at
once, not individual sessions.

Hmmm, interesting. So could this be a feature request for that extension, then?

Not a simple one, though. As long as you terminate all sessions at the same time, it is enough to keep a single token in the user table and replace it when every session needs to be logged out. For per-session logout, you would need some kind of table keeping track of sessions.

T110277 will fundamentally change session handling.

As far as I know, we save information about the session, perhaps now it only needs to be displayed?

In T58212#7951705, @Iniquity wrote:

As far as I know, we save information about the session

We don't, on several levels:

• We don't store information that would help the user identify the session (IP/geodata, user agent etc).
• We do not store the sessions in such a way that would allow querying all sessions for a given user - they are just values in a key-value store that's keyed by the session cookie's value (although Wikimedia uses Cassandra for that, so infrastructurally a secondary index by user ID wouldn't be a big change, but it would have to circumvent all the session store abstractions in MediaWiki, which don't assume anything beyond a key-value store).
• Most crucially, sessions (in the MediaWiki sense) aren't even that relevant to staying logged in. They have a short lifetime; what the user perceives as long-term "sessions" are really just tokens stored in the user table and matched against a long-lived cookie. That's going to be the same token for all devices where the user is logged in; there isn't any kind of individual data structure for each of those devices.