Re: HTTP authentication and session timeout

["Craig Skelton" <craig () craigskelton com>]

Hmm. Perhaps I wasn't clear.

You are correct, the browser sends the auth string. That's what I get for
sending email prior to the first cup of coffee.

In perl (CGI), try this:
#!/usr/local/bin/perl
$url = "http://loggedout:blank () the current url";
print "Location: $url \n\n";

or in php try this:
<?php header( 'Location: http://loggedout:blank () the current url' ); ?>

or in asp try this:
<% Response.Redirect "http://loggedout:blank () the current url" %>


----- Original Message -----
From: "Jason Coombs" <jasonc () science org>
To: "Craig Skelton" <craig () craigskelton com>; <webappsec () securityfocus com>;
"'UDP 53'" <udp53 () hotmail com>
Sent: Monday, November 25, 2002 11:53 AM
Subject: RE: HTTP authentication and session timeout


> Re-read RFC 2617
>
> http://www.ietf.org/rfc/rfc2617.txt
>
> The server doesn't send the authentication credentials to the client, it's
> the other way around.
>
> Closing all browser windows and restarting the browser is the only way to
> clear the Basic Authentication cached credentials on the client unless
> Internet Explorer is used and a custom ActiveX Control is built per
>
> Q195192 HOWTO: Clear Logon Credentials to Force Reauthentication
> http://support.microsoft.com/default.aspx?scid=KB;en-us;195192&;
>
> Browser programmers are not told clearly in RFC 2617 whether the Realm
> should have anything at all to do with determining the equivalence of one
> password-protected resource with another, and FQDN is therefore used
instead
> by all browsers while Realm is merely eye candy for the end-user.
>
> Sincerely,
>
> Jason Coombs
> jasonc () science org
>
> -----Original Message-----
> From: Craig Skelton [mailto:craig () craigskelton com]
> Sent: Monday, November 25, 2002 5:28 AM
> To: webappsec () securityfocus com; 'UDP 53'
> Subject: Re: HTTP authentication and session timeout
>
>
> The auth string is initially sent to the browser from the server as a
base64
> encoded pair. From the server side, you can override the current auth
> string by simply sending a new one. Send a blank string or a string with
> invalid data, and you have effectively logged out the user...
>
> One has to point out that this inherently means the connection must be
> statefull in some way, since you must know when and who to
> timeout.Therefore, I wonder why you would really want to stick with basic
> http auth?