log out
An explicit, user-initiated action — or a system-enforced equivalent — that terminates an authenticated session, invalidates associated session credentials (tokens, cookies, or session identifiers), and returns the subject to an unauthenticated state requiring re-authentication for further access. It is distinguished from a session lock, which merely suspends access temporarily while keeping the session alive, and from an automatic timeout, which achieves the same end-state by system policy rather than user volition; session locks are not an acceptable substitute for logging out of information systems — for example, when organizations require users to log out at the end of workdays. Across the field it functions both as a behavioral control — requiring users to take physical action when they are expecting inactivity longer than a defined period — and as a technical security boundary: session termination is an important part of the session lifecycle, and reducing to a minimum the lifetime of session tokens decreases the likelihood of a successful session hijacking attack.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 3 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An explicit, user-initiated action — or a system-enforced equivalent — that terminates an authenticated session, invalidates associated session credentials (tokens, cookies, or session identifiers), and returns the subject to an unauthenticated state requiring re-authentication for further access. It is distinguished from a session lock, which merely suspends access temporarily while keeping the session alive, and from an automatic timeout, which achieves the same end-state by system policy rather than user volition; session locks are not an acceptable substitute for logging out of information systems — for example, when organizations require users to log out at the end of workdays. Across the field it functions both as a behavioral control — requiring users to take physical action when they are expecting inactivity longer than a defined period — and as a technical security boundary: session termination is an important part of the session lifecycle, and reducing to a minimum the lifetime of session tokens decreases the likelihood of a successful session hijacking attack.DR-088 backfill from the noun definition column