utlogging

Utlogging, or logging out, is the process of terminating an active user session with a computer system, application, or online service. The action ends the authenticated state for the current user and typically requires the user to re-enter credentials to regain access. In web applications, logout usually involves invalidating the server-side session and removing or expiring the session token stored in a cookie or local storage. In native or mobile apps, logout generally clears locally stored credentials and revokes tokens used for API access.

There are several types of logout. An explicit logout is initiated by the user through a sign-out control. Automatic logout occurs when a session expires after a period of inactivity or when an absolute timeout is reached. In systems that support single sign-on, a logout may propagate to linked services through a single sign-off mechanism.

Implementation considerations include secure session management, token invalidation, and proper handling of cookies (for example, setting appropriate SameSite attributes). Logout should also ensure that residual authentication data is removed from the device to prevent unauthorized reuse, especially on shared devices. Proper protection against common threats such as session fixation and cross-site request forgery is important.

From a usability and security perspective, logout controls should be easy to find, and systems should clearly communicate when a session has ended. Privacy considerations may affect whether logout actions are logged and for how long audit trails are retained.