User log Out with external redirect does not log out - Security Risk

Update:

I have also noted this exact behaviour using a logout link like

user/logout?destination=external_url

Has anyone else seen this behaviour? I believe that this presents a security risk - because if a user logs out on a public computer using this method - they unknowingly leave their account entirely open.

From the investigations I have done - it appears that the logged in session survives the logout or somehow gets resurrected before the user is redirected.

Changed description to more accurately describe issue

No one want to touch this one - so I'll have a conversation with myself in the hope that it might help anyone else who experiences this issue - this is what I believe the situation is.

on logout - currently - using an external url redirect cannot work - I am surmising that this is because the system redirects BEFORE the session cookie can be modified. ie the cookie changes never land on the local domain. Using a local url does work but of course is not the behaviour I wanted.

One solution that should work is to redirect to a local page, where you have inserted a bit of javascript redirect code on the onload event. This should allow the session cookie to be properly modified/deleted before redirecting to the external site.

I'm not sure if this is a bug or a documentation issue - I looked for a definitive statement on the redirect behaviour but it is either not there or I missed it - either way I'll leave it to someone who knows definitively to mark this issue appropriately.

The ONLY way I have found that works is to use the method I speculated about in #3.

Create a blank page ( or in a module ) and add a javascript method that redirects to your desired page in the document onLoad event. I did it in a module ...

function MY_MODULE_menu(){ 

    $items['log/out'] = array(
        'page callback' => 'MY_MENU_FUNTION_user_logout',
        'access callback' => true, , 
        'access arguments' => true,
        'type' => MENU_CALLBACK,
       );                              
      
      return $items; 
}

function MY_MENU_FUNTION_user_logout(){
    $build=array();    
    drupal_add_js('jQuery(document).ready(function () { window.location = "http://example.co.uk";})', 'inline'); 
    $build['#markup']="LOGGED OUT";
    return $build;
}

The only downside is that there is a brief "Flicker" on th blank page before it redirects.

It works very reliably. The User IS logged out and IS redirected to the external site. I'm sure there is a - smoother way of doing this - but its a start!

Hope this helps.