log out
163519·updated Aug 30, 2026An explicit, user-initiated action — or a system-enforced equivalent — that terminates an authenticated session, invalidates associated session credentials (tokens, cookies, or session identifiers), and returns the subject to an unauthenticated state requiring re-authentication for further access. It is distinguished from a session lock, which merely suspends access temporarily while keeping the session alive, and from an automatic timeout, which achieves the same end-state by system policy rather than user volition; session locks are not an acceptable substitute for logging out of information systems — for example, when organizations require users to log out at the end of workdays. Across the field it functions both as a behavioral control — requiring users to take physical action when they are expecting inactivity longer than a defined period — and as a technical security boundary: session termination is an important part of the session lifecycle, and reducing to a minimum the lifetime of session tokens decreases the likelihood of a successful session hijacking attack.
Source
is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement ofthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A user-initiated access-control action that voluntarily and explicitly terminates an authenticated session, invalidating the associated session credentials (tokens, cookies, or server-side session state) so that the account's privileges are no longer exercisable without re-authentication. It is stronger than a screen lock: a locked workstation may preserve application sessions, whereas logging out ends the session and typically clears session tokens and cookies. Standards and frameworks treat it as a distinct, affirmative security control — session locks are temporary measures for short absences and are not an acceptable substitute for logging out, which organizations may require, for example, at the end of the workday. In practice, authority documents mandate that users log out of the system after an organization-defined period of expected inactivity or when specified circumstances occur, and that secrets used for session binding be erased on the subscriber endpoint when they log out or when the secret is deemed to have expired.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- log outs
- possessive
- log out's
- pluralpossessive
- log outs'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 3 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An explicit, user-initiated action — or a system-enforced equivalent — that terminates an authenticated session, invalidates associated session credentials (tokens, cookies, or session identifiers), and returns the subject to an unauthenticated state requiring re-authentication for further access. It is distinguished from a session lock, which merely suspends access temporarily while keeping the session alive, and from an automatic timeout, which achieves the same end-state by system policy rather than user volition; session locks are not an acceptable substitute for logging out of information systems — for example, when organizations require users to log out at the end of workdays. Across the field it functions both as a behavioral control — requiring users to take physical action when they are expecting inactivity longer than a defined period — and as a technical security boundary: session termination is an important part of the session lifecycle, and reducing to a minimum the lifetime of session tokens decreases the likelihood of a successful session hijacking attack.DR-088 backfill from the noun definition column