In math/CS, "idempotent" means "has the same effect when done 1 time as when done n>1 times."
In HTTP, GET requests are often described as "idempotent" by someone who actually means "nullipotent" (i.e. "has the same effect when done 0 times as when done n>0 times"). This is because the spec describes GET, PUT, and DELETE requests as idempotent - which they are, it's just that GET requests are nullipotent as well.
Wikipedia mentions this briefly:
http://en.wikipedia.org/wiki/Idempotent#Computer_science_mea...
Therefore the results are different for different states and it is not idempotent.
In this case, logging out multiple times does not change anything from the first application.
sending notifications, updating counters, etc. all could be result of logging out.
Now, you got a point about idempotence from the server's point of view. However, it would take a _badly_ programmed website for the logout operation to _not_ be idempotent. Sending notifications, updating counter, etc. _without first checking if the user is really logged in or not_ is simply moronic. This simple check is what would turn the logout operation into an idempotent one in the server too.
No, from all states, the result is that you're logged out.
Similarly, changing a customer's address is typically
idempotent, because the final address will be the same
no matter how many times it is submitted.
[1] http://en.wikipedia.org/wiki/Idempotence#Computer_science_me...
Edit: Next paragraph says:
This is a very useful property in many situations, as it means that an operation can
be repeated or retried as often as necessary without causing unintended effects.
With non-idempotent operations, the algorithm may have to keep track of whether the
operation was already performed or not.
The HTTP spec clearly talks in terms of the effect of sequences of repeated operations, not in terms of the results of individual operations. The side effects of a single logout are the same as for 6 - you are logged out and whatever logout triggers exist are executed once.
[1] http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1...
You got that mixed up. Idempotent requests mean that the result is exactly the same even if issued multiple times. In the case of a logout, idempotency is pretty much granted even when using GET requests. The idea here is that GET request should not change the state of the application, because the browsers are happy about opening the same URL multiple times without user confirmation. For instance, a "post/delte/last" URL that deletes your last post would be a terrible idea, because of the following scenario:
The <img> URL issue is a separate concern: that of Cross-Site Request Forgery (CSRF). The easiest way to protect from this security issue is to require a single-use token for each request that changes the application state. You can read more about it at the Open Web Application Security Project website: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%...