---
title: "Put sign-out on every signed-in page · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/sign-out-link
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Put sign-out on every signed-in page

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/accounts/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Show a sign-out control in the header or main menu of every signed-in page, at most one click or tap away. Signing out ends the session on the server.
- Applies when: The project it has user accounts.
- How: The OWASP Session Management Cheat Sheet asks for a visible sign-out in the header or menu, reachable from every page. NIST SP 800-63B-4 asks for an easy way to end a session. People on shared or borrowed computers need it most. Put it in the shared layout, so no page can leave it out. Make it a form that posts, so a link cannot sign someone out from another site. Delete the session row, as [let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions) does. Clear browser data as [clear site data on sign-out](https://agentwranglers.se/playbook/website/security/clear-site-data) says.
- Check: A browser test signs in and opens every signed-in route, at phone and desktop width. Each page has a sign-out control within one click. After using it, the old cookie gets 401.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { test, expect } from '@playwright/test';
import { signedInRoutes } from './routes.js';

for (const route of signedInRoutes) {
  test(`sign-out is one click away on ${route}`, async ({ page }) => {
    await page.goto(route);
    const signOut = page.getByRole('button', { name: 'Sign out' });
    if (!(await signOut.isVisible())) await page.getByRole('button', { name: 'Menu' }).click();
    await expect(signOut).toBeVisible();
  });
}
```

### Python example

```python
import pytest
from playwright.sync_api import Page, expect
from routes import SIGNED_IN_ROUTES

@pytest.mark.parametrize("route", SIGNED_IN_ROUTES)
def test_sign_out_one_click_away(signed_in_page: Page, route: str):
    signed_in_page.goto(route)
    sign_out = signed_in_page.get_by_role("button", name="Sign out")
    if not sign_out.is_visible():
        signed_in_page.get_by_role("button", name="Menu").click()
    expect(sign_out).to_be_visible()
```

## Sources

- [OWASP Session Management Cheat Sheet on the logout button](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#logout-button)
- [NIST SP 800-63B-4 on session management](https://pages.nist.gov/800-63-4/sp800-63b.html#sessmgmt)

## Related rules

- [Let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions) in Accounts
- [Wipe browser data on sign-out](https://agentwranglers.se/playbook/website/security/clear-site-data) in Website

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/sign-out-link">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log)
- Next: [Let organisation owners sign a member out](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)