# How to log out user if I don't know them?

**URL:** <https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273>\
**Category:** Development\
**Created:** [March 23, 2020, 5:20pm UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273 "2020-03-23T17:20:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![pnoeric](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pnoeric/32/177144_2.png) [@pnoeric](https://meta.discourse.org/u/pnoeric)\
**Post date:** [March 23, 2020, 5:20pm UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/1 "2020-03-23T17:20:20Z")

</div>

Ok-- imagine this simple scenario:

1. User A logs into my site and then clicks ‘Forums’ on the site. They are redirected to Discourse, which calls back to my site via SSO and they’re authenticated and automatically logged into Discourse. Great, works perfectly.

2. After a while, User A walks away from the computer and their session expires automatically. They never specifically click log out in my app OR on Discourse.

3. User B logs into my site _on the same device,_ clicks to go to the forums, and since Discourse still has User A logged in, never calls for SSO since the Discourse session is logged in. Now User B is logged into Discourse as User A. :-\

How can I handle this scenario?

Thanks,  
Eric

---

<div class="post-metadata">

**Author:** ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)\
**Post date:** [March 23, 2020, 5:29pm UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/2 "2020-03-23T17:29:54Z")

</div>

You can hookup an api call to automatically log out discourse:

> **[Discourse API Docs](https://docs.discourse.org/#tag/Users/paths/~1admin~1users~1%7Bid%7D~1log_out/post)**

---

<div class="post-metadata">

**Author:** ![pnoeric](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pnoeric/32/177144_2.png) [@pnoeric](https://meta.discourse.org/u/pnoeric)\
**Post date:** [March 23, 2020, 7:02pm UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/3 "2020-03-23T19:02:21Z")

</div>

Right, but how can I do this if the user has “walked away” from the computer and their session expired? Maybe this is more of a PHP question (which is what my main site is written in)…

---

<div class="post-metadata">

**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\
**Post date:** [March 23, 2020, 10:10pm UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/4 "2020-03-23T22:10:36Z")

</div>

This trick should still work:

> [@Is there a "log\_in" SSO API endpoint?](https://meta.discourse.org/t/is-there-a-log-in-sso-api-endpoint/33545/2):
>
> You can’t set cookies for another domain from the server, so that wouldn’t work stuck_out_tongue Try giving the user a page with this on it: \<embed src="https://discourse.example.com/session/sso" onload="window.location='/login\_finished'" width=0 height=0\> \<div style="display:flex;justify-content:center;align-items:center"\> \<div class="loading-spinner"\> \<h1\>Please wait, logging you into Discourse...\</h1\> \<aside\>\<a href="/login\_finished"\>Click here if you don't want to wait\</a\>\</aside\> \<…

---

<div class="post-metadata">

**Author:** ![itsbhanusharma](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/itsbhanusharma/32/180717_2.png) [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)\
**Post date:** [March 24, 2020, 3:30am UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/5 "2020-03-24T03:30:06Z")

</div>

@riking I’m sorry, I had a curious question.

How do services like auth0 handle automatic logout for discourse?

---

<div class="post-metadata">

**Author:** ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)\
**Post date:** [March 24, 2020, 3:47am UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/6 "2020-03-24T03:47:23Z")

</div>

> [@pnoeric](#):
>
> User A walks away from the computer and their session expires automatically. They never specifically click log out in my app OR on Discourse.

> [@pnoeric](#):
>
> After a while, User A walks away from the computer and their session expires automatically.

Could you clarify what you mean by this? What is the session length for your app? How are you handling session expiration there?

Discourse has a `maximum session age` setting which by default is set to 1440 hours, which is 60 days.

The short version is that if you don’t know the user at the computer has changed, there’s nothing you can easily do to prevent it. You could dial the session length down, or periodically call from your app to log out users, but then if your users are at the computer for longer periods of time, they’re going to find themselves going back through the authentication flow.

Discourse can extend whatever login and session flow you currently use, but without more information on the above it’s hard to see exactly where the problem and any opportunities lie.

---

<div class="post-metadata">

**Author:** ![pnoeric](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pnoeric/32/177144_2.png) [@pnoeric](https://meta.discourse.org/u/pnoeric)\
**Post date:** [March 26, 2020, 9:15am UTC](https://meta.discourse.org/t/how-to-log-out-user-if-i-dont-know-them/145273/7 "2020-03-26T09:15:04Z")

</div>

Thank you for your reply! I realized that this problem ultimately is all about managing the user on the main site.

If the user manually logs out of the main site, then I have to call Discourse (via API) to log them out there as well.

And if the user doesn’t log out but their session expires, I have to call Discourse to log them out there at the same time.

And finally: when a user logs out of Discourse using “log out” there, I need to capture that event (via webhook) and log them out on my site too.

Whee, integration!