Menu
HTTP basic authentication credentials are stored until the browser is closed, but is there a way to remove the credentials before the browser is closed?
I read about a trick with HTTP 401 status code, but it seems to work not properly (see comment to answer). Maybe the mechanism trac uses is the solution.
Can the credentials be deleted with JavaScript? Or with a combination of JavaScript and the status 401 trick?
731
Basic Authentication wasn't designed to manage logging out. You can do it, but not completely automatically. What you have to do is have the user click a logout link, and send a '401 Unauthorized' in response, using the same realm and at the same URL folder level as the normal 401 you send requesting a login.
You can store your Authorization header values in localStorage or sessionStorage. The value of Authorization header, stored in LocalStorage, will be automatically each time you make HTTP requests.
Note: The HTTP basic authentication scheme can be considered secure only when the connection between the web client and the server is secure. If the connection is insecure, the scheme does not provide sufficient security to prevent unauthorized users from discovering the authentication information for a server.
For HTTP basic authentication, each request must include an authentication header, with a base-64 encoded value. Where siteName is the company name you use to log in to Eloqua, and username and password are your Eloqua username and password.
Update: This solution does not seem to work anymore in many browsers. Kaitsu's comment:
This solution of sending false credentials to make browser forget the correct authenticated credentials doesn't work in Chrome (16) and IE (9). Works in Firefox (9).
Actually you can implement a workaround by sending false credentials to the service. This works in Browsers by sending another (non-existent?) Username without a password. The Browser loses the information about the authenticated credentials.
Example:
https://www.example.com/ => Log in with basic auth as "user1"
Now open
https://[email protected]/
You're Logged out. ;)
Regards
P.s.: But please test this with all needed Browsers before you rely on the given information.
69
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
