Logout should mean logout. Why doesn't it across most apps?

you hit logout. the app says you're out. but somewhere, on another device, on another app using the same login, your session is still alive.

most users assume logout means logout everywhere. it doesn't. it usually means logout from this tab, on this device, right now. everything else keeps running until the token expires.

this happens because most auth setups issue JWTs and forget about them. once the token is out, there's no way to pull it back. the app that issued it has no channel back to the apps using it. so logout is really just 'stop showing the user interface.' the access underneath is still valid.

it gets worse in shared device environments. kiosks, family devices, office computers. someone logs out and walks away assuming they're safe. they're not.

and it gets really bad when an account is compromised. you spot the breach, you force a logout, and you have no idea if that logout actually reached everywhere it needed to.

the fix exists. back-channel logout, session-bound tokens, real-time introspection. but most teams don't build it because it's not visible until something goes wrong.

curious how people are handling this. does logout in your product actually mean logout everywhere, or are there still sessions floating around that nobody's thought about?