Fix: Signed-Out Sessions Stayed Active on Our Servers

Details

Signing out used to clear the session from your browser, which is what you see, but the session itself stayed valid on our side for a while longer. Anyone who had managed to copy it off your machine could still use it. Now signing out cancels the session on our servers immediately, including any live connection it had open, so those saved copies stop working the moment you sign out. Your other devices are untouched: signing out on your laptop does not sign you out on your phone. Reported to us privately by a security researcher, who we thank on our Security Hall of Fame page.

What changed

• Signing out cancels the session on our servers, not only in your browser
• A session copied from your browser stops working the moment you sign out
• Live connections from that session are closed too
• Your other devices stay signed in