988446 - disconnect from sync should sign out user from accounts.firefox.com/settings

Status: RESOLVED FIXED

(Firefox :: Sync, defect)

Description

[Edwin Wong [:edwong]]

1. sign into fxa in about:accounts
2. poke preferences > disconnect
3. goto: https://accounts.firefox.com/settings

actual: it shows I'm signed in.  A user can walk up to the machine and delete you account now.

expected: it should sign you out.

Comment 1

[James Bonacci [:jbonacci]]

To me, this feels like two different flows...
Disconnect drops this device from the current account.
But, you may have other reasons for still be logged into your FxA account.

That feels different than signing out from the FxA account (which should not disconnect the device from the sync account).

I don't know - I have not tracked the desktop changes to the UI lately.

Should "disconnect" = "sign out of account"?

By the way, I can not find in the UI an option to actually sign out of the account - I can only find links to change password and delete the account.

Comment 2

[Edwin Wong [:edwong]]

:jbo It's actually good to hear that you and other users like you will see there's a distinction between 'account manager' and 'signed into browser'.  The loose coupling blurs the line for me and between the two systems:

When you Sign In to Fx:
* and click on 'manage' you get auto signed into the 'account manager portal'

When you disconnect on Fx:
* actual: your email will remain signed into 'account manager portal'
* expected: you should get signed out.

Chris asserts that there will be more attached services and this will help shape the account management portal. However, I would argue that today, the coupling we do confuses the user.  We should create a hard line between the two or connect the systems all the way, not the current mix of the two.

While any changes to the system can lead to other issues, I think UX needs provide a bit of roadmap for the account management portal

Comment 3

[Ryan Feeley [:rfeeley]]

This was considered, although we do imagine more services (in the browser, and on the web) making use of the Firefox Account. In Chrome, for example, when you sign into Chrome with your Google Account, so you also are signed into Google properties elsewhere (drive, search, etc.).

When you "disconnect" chrome, your Google session remains active on the web. And as with our account, deleting the account does require a password confirmation.

We definitely want users to understand that 'account settings' are for the account, and not the application.

Comment 5

[Chris Karlof [:ckarlof]]

Since Disconnect destroys the session token, then you should then get logged out of the settings page on the web too.