Signing in as somebody else

What happens, in order#

1. Somebody chooses to add or switch account, and signs in at Google.

   Result Connect reads who this browser was signed in as *before* creating anything new. That order matters: after the new session exists there is no longer a reliable way to ask the question.

2. Connect creates the new session and sets the cookie.

   Result The browser is now the new person. The old cookie is gone from it regardless of what happens next.

3. If the person who was signed in is a different person, their session is revoked.

   Result The revocation is recorded, naming who was ended and who replaced them. The old token is dead from that moment.

4. Nothing else is touched.

   Result The previous person's other sessions — a phone, a second laptop, a different office — are not consulted and not changed.

Why the old session is ended rather than dropped#

Replacing the cookie is enough to change who the browser is. It is not enough to make the old session safe. A session whose cookie has been overwritten is still a valid row: still inside its lifetime, still listed under the previous person's active sessions, and still usable by anyone holding a copy of its token. Nobody is watching it, because from the screen's point of view that person has moved on.

Ending it closes that gap, and closes it in the place where somebody actually has the evidence: at the moment of the replacement, when Connect still knows both identities. It also makes the security screen honest — the previous person's session list stops showing a session that nothing is using.

Signing in as yourself again#

Signing in again as the same person is a different case, and the difference is deliberate. Connect compares the identity that was there with the one arriving; when they match, nothing is revoked. You get a fresh session, the cookie is updated, and any session you had on that browser before is left alone rather than terminated as though you were an intruder.

The practical effect is that a re-sign-in never costs you access anywhere. If you want the opposite — every other device out, including your own — that is 'sign out of other devices' on the security screen, which is an explicit action rather than a side effect.

What is and is not affected#

On a shared device#

• Sign out when you leave rather than relying on the next person to sign in. Ending your own session is immediate and does not depend on anybody else's behaviour.
• If you have already left, use 'sign out of other devices' from a device you do hold. It ends every session except the one you are on, which is exactly the right shape for this problem.
• Check the account screen afterwards. A device you do not recognise, or one whose last-seen time makes no sense, is worth acting on rather than explaining away.
• Do not share one Google account between colleagues to avoid the switch. Every decision Connect records is recorded against a person, and a shared identity makes the whole audit trail say the same wrong name.

Questions#

Related#

• Sessions
• Security settings
• Signing in with Google
• Account and access
• Signing out and replacing a session
• You were signed out
• One implementation, two audiences