HTTP authentication - How do I make the user overwrite Authentication data?

Question

I know I can't logout an HTTP authentication.

Overwriting through the Location: http://logout:[email protected]/ way seems to work on most browsers, except IE.

I was wondering however if I could let the users overwrite the Authentication data.

So say the user has some auth data in its browser, now they go to my /logout page, and it sends back the 401 headers so that the authentication window pops up and they can overwrite it.

However, when they click OK (auth data is now overwritten in the browser) the /logout page reloads, and there's no way for me to validate the new data because the page will reload after I clicked OK and it will run the Auth headers again and it will show the popup again.

So basically, how do I validate HTTP auth data if there's already some data set in the browser?

Answer 1

when they click OK (auth data is now overwritten in the browser) the /logout page reloads, and there's no way for me to validate the new data

You just have to reverse-validate the submitted data: if the user supplies proper auth, return the 401 response; if the user supplies bad auth or no auth, return a 200 or 302 to signal that the new bad/no auth has been accepted. The browser will then continue to use the bad/no auth for future requests.

Add directions something like “Click here and then enter no username or password and click OK” and you've got yourself a workable, if slightly shonky logout feature for HTTP Basic Auth.

(This is easy assuming you're spitting out the auth headers yourself from a script; it's not generally possible to pull off if you're using your web server's Authentication handling features.)