This retains your session code, right?
Confusingly, there are two unrelated things using the word "session":
- Your "login session" is terminology for "the thing which keeps you logged in". It's associated with your "SMFCookie129" cookie.
- Your "session code" is the thing after
;sesc= in many links. It's associated with your "sessionid" cookie, and is what prevents CSRF-type attacks. (It's called a session code because it uses the PHP session system, and the cookie is a session cookie.)
If you just delete your SMFCookie129, or it expires, or you abandon that browser, then your login session in
that browser will be gone, but all other logged-in sessions will remain. Actually clicking the "logout" button kills
all login sessions, everywhere. (As does changing your password.) Using the
sa=salt hidden link kills all login sessions except for the current one.
Logging out or visiting the
sa=salt link does not typically change your session code.
I tried using this link instead:
action=logout doesn't take
sa=salt, so that's exactly the same as the normal logout link. So as expected, it logged you out everywhere.
In URLs, "sa" stands for "subaction".
logout doesn't have any subactions.
login2 has subactions
salt and
check. You have to use the right actions for each subaction.