She clicked sign out.
The screen went back to the login page,
the browser storage was cleared,
and the token she had been carrying
went on working for nine more days.
Because nothing was told.
A signed token is not a session.
It is a letter your server wrote,
saying this person is who they say
until a date printed inside it,
and that letter is valid
wherever it turns up,
for as long as it says,
whether or not the holder
has been anywhere near your login page.
Signing out deletes your copy.
It does not reach the copy
in the proxy log,
the copy in the crash report,
the copy in the terminal history
of the machine she borrowed.
Now line up the moments
that everyone assumes end access.
Changing a password.
Removing a role.
Disabling an account.
Walking somebody out of the building
on the last Friday of the month.
Each of those feels final.
Not one of them, on its own,
stops a letter you already wrote.
So the gap is not a flaw in the design.
It is the design,
and it is a fine design
as long as you know
that revocation is a feature
you have to build separately
and probably have not.
The dull fixes hold.
Keep the letters short lived.
Minutes, not weeks.
Long enough to be useful,
short enough that expiry
does the work of revocation
when everything else fails.
Hold the long lived half server side,
in a list you can actually delete from,
and treat that list as the truth.
Put a number on every user record
and raise it when anything changes
that ought to end a session.
Password, role, status, suspicion.
Every letter carries that number.
Old number, refused.
Give people sign out everywhere
and put it somewhere findable,
because the person who needs it
has already lost a laptop
and is not in a mood to hunt.
And write down what happened,
so that when somebody asks
whether the leaver still had access,
the answer is a record
and not a shrug
and not a reassuring guess
made by whoever was nearest.
– Serguey Asael Shinder
