2010- 2009
- 2008
- 2007
- 2006
2005
Shell Acoustics- Context Menus
- Security Lecture
- Unfortunate Typo
- Logging Out
- Switch
- Through the Looking Glass
- Scotland Video
- Comma Separated Values
- OU-M880 (Soft Eng)
- Cycling Britain
- Hidden Costs
- Hiring
- Golden
- Style vs Substance
- Bess
- Ajax Content
- DHTML Client
- Over There
- Content Hijacking
- Raw Statistics
- Trying to Fail
- SETI@home 2500
- Security Separation
- Gamma Ray Bursts
- Fishy Behaviour
- Moo Browser
- Caption this Photo
- All Good Things
- Dalek
- Moo Direction
- Open University
- OU-M865 (Projects)
- OU-M876 (Data)
- OU-M886 (Security)
- OU-M878 (Objects)
- OU-M874 (Java)
- OU-M873 (UI)
- Einstein's Riddle
- Glowing Books
- Hogmanay
- 2004
- 2003
- 2002
Logging Out
14 November 2005
From Apache's Authentication, Authorization, and Access Control FAQ:
How do I log out?
Since browsers first started implementing basic authentication, website administrators have wanted to know how to let the user log out. Since the browser caches the username and password with the authentication realm, as described earlier in this tutorial, this is not a function of the server configuration, but is a question of getting the browser to forget the credential information, so that the next time the resource is requested, the username and password must be supplied again. There are numerous situations in which this is desirable, such as when using a browser in a public location, and not wishing to leave the browser logged in, so that the next person can get into your bank account.
However, although this is perhaps the most frequently asked question about basic authentication, thus far none of the major browser manufacturers have seen this as being a desirable feature to put into their products.
Consequently, the answer to this question is, you can't. Sorry.
Bzzt. Wrong answer. Here's a demo of how to logout using HTTP authentication:
- Login now
- Username: user
- Pasword: pass
The strategy is to setup two authenticated users, the real user and a 'nobody' user. Then one embeds a little-known in-line authentication method within the logout link which switches the username to 'nobody'. View source on the login page to see what this looks like. Also worth reading is the .htaccess file which controls the authentication.
Update: Henric and Mathieu both pointed out that Microsoft recently pushed out this security update for IE 6 which completely disables inline authentication on links. Which means the above technique no longer works on most people's browsers. No work arounds. Game over. Thank you Microsoft.
