log out

An explicit, user-initiated action — or a system-enforced equivalent — that terminates an authenticated session, invalidates associated session credentials (tokens, cookies, or session identifiers), and returns the subject to an unauthenticated state requiring re-authentication for further access. It is distinguished from a session lock, which merely suspends access temporarily while keeping the session alive, and from an automatic timeout, which achieves the same end-state by system policy rather than user volition; session locks are not an acceptable substitute for logging out of information systems — for example, when organizations require users to log out at the end of workdays. Across the field it functions both as a behavioral control — requiring users to take physical action when they are expecting inactivity longer than a defined period — and as a technical security boundary: session termination is an important part of the session lifecycle, and reducing to a minimum the lifetime of session tokens decreases the likelihood of a successful session hijacking attack.