How to test a logout button
Testing the logout button. You just click a button, and you're done, or are you? It sounds deceptively simple, and if you think that, you'd be half right, but I think there is more to it than that. As a tester for over a decade now, I have been guilty of the above thinking, but my experience has taught me better. The logout button looks like a one-line test case on paper.
What does logout actually do?
The logout button isn't just a button. It is a system of control for identity, security, session state, and access to come together. A reliable logout process should clear session tokens and cookies. Consistently end sessions across devices and networks. Handle failures or interruptions safely, and remain accessible to all users. Ultimately, logout is a coordinated security control, not simply a UI action.
Now, how do we approach testing the logout button? I am using Amazon for the purpose of this article.
The ‘obvious’ test:
Sign up or log in and then immediately log out. You can also do a variation of this. Log in, add something to the cart or make a purchase, then log out. In each case, you will (should) get logged out successfully.
This is the test everyone runs, and it's the easiest to pass. It's also the least interesting part of testing a logout button, which is exactly why so many bugs slip through everything below.
The ‘not so obvious’ tests:
Session behaviour:
Once logged out, click the back button on your browser, and you will be redirected to the previous page (in my case that's the homepage) but signed out. This should remain the case no matter how many times you press the back button.
Once logged out, refresh the page and it will reload to the same page but remain signed out.
Log in on a browser and switch accounts. It will (should) log out of the previous session. It just saves you from typing new credentials and lets you switch immediately.
Log in on the same browser but open the account in two separate tabs, not incognito, just two tabs of the same session. Log out in one tab, then go to the second tab and try to interact with it. Refresh the page. You will land back on the same page, but you will be signed out and will (should) be asked to sign back in.
Cross-context behaviour:
Log in on 2 different browsers (Chrome and Edge) and log out on one of them (Chrome). You will be logged out of Chrome and remain logged in on Edge because they are 2 separate sessions.
Log in on the same browser in different sessions (standard and incognito), then log out of incognito. You will not get logged out of the standard session again because the sessions are separate and independent.
Log in on 2 different devices (Chrome on desktop and mobile) and log out on desktop. It will remain logged in on mobile. Same reason as the 2 tests above.
Network behaviour:
Turn on airplane mode, click logout, you will get an error and then reconnect. Upon reconnecting you will be logged out. This scenario is often skipped, but it matters a lot for anyone on a patchy mobile connection or public wifi.
What happens if you log out while something is actually in progress? Start the checkout process, get to the checkout step, then open a second tab and log out there. Go back to the checkout tab and try to continue. You will be logged out when you try continuing.
Another nuanced test could be to add items to your basket without logging in, log in. The basket persists. The state does not get wiped when you log in. This is worth including because it tests logout not as an isolated click, but as something that can interrupt other flows mid-stream.
Click the logout button twice in quick succession, or open two tabs and hit logout in both at nearly the same time. Does the second request throw an error, silently no-op, or cause something odd like a broken redirect?
I couldn't test the above on Amazon's site, and it may sound trivial, but double-submission bugs are common and cheap to catch early.
Single sign-out across related services: If the platform has associated services under the same account for Amazon, that could be Prime Video, Audible, AWS, or Kindle, log into a couple of these in parallel, then log out from the main account. The associated services also lose their session they only carry on independently if they are each on different devices as mentioned above This is really testing whether logout is scoped correctly across a broader ecosystem of services, not just the one app in front of you.
Security and Accessibility
"Remember me" and auto-login: From a security perspective, there could be a "remember me" or "stay signed in" option. Test it directly against logout. Log in with the option checked, then log out. The token should clear and ask you to log back in. Amazon doesn't explicitly have either checkbox, but it automatically sets a long-lived cookie that keeps a user signed in until they manually sign out.
This is a genuinely common bug. The visible session ends, but a long-lived cookie survives underneath it. One important thing to note. When you're on a shared or public computer, it is recommended to manually sign out when done. Otherwise, other users may see your personal information.
Also try replaying the authenticated request:
Log in > Open DevTools → Network > Navigate to a page that calls an authenticated API, e.g., the checkout page (https://www.amazon.co.uk/checkout) > Copy the request (or use Postman) > Log out > resend the exact same request. The correct result should be a 401 Unauthorised response, 401 Forbidden response or something along those lines indicating that the request is rejected and not authorized.
You can also copy the URL and paste it into the same tab or a new tab. The result should be the same.
- From an accessibility perspective, is the logout button reachable and operable via keyboard alone, tab to it, activated with Enter or Space?
- Does a screen reader announce it clearly, e.g. "Log out, button," rather than an unlabelled icon?
Final thoughts
So, is testing the logout button “just clicking a button?” Not even close. Logout isn’t really a button. It's a boundary of the system, the line where a valid session should end, and access should stop. Bugs love boundaries. They gather at the edges, in a cookie that doesn’t expire, a tab that didn’t close, a retry that quietly reopens a door you thought was shut.
You now know what logout is meant to do and every place it's meant to reach, so you know exactly where to look when it doesn't. The next time someone hands you "test the logout button" as a five-minute task, you'll know it's anything but.