Voting

The Note You're Voting On

5 years ago

In writing the HTTP auth module for the Gallery project, we discovered the following tricks for logging out with HTTP authentication:



Because most web browsers cache HTTP auth credentials, the Gallery logout link didn't work as expected after logging in with HTTP auth. Gallery correctly logged out the active user but the web browser simply logged in again with the next request.



To work around this, the HTTP auth module listens for the Gallery::Logout event and delegates to the httpauth.TryLogout page if necessary: http://gallery.svn.sourceforge.net/viewvc/gallery

/trunk/gallery2/modules/httpauth/TryLogout.inc?view=markup



The TryLogout page tries clearing the browser's authentication cache by as many tricks possible:



    * Ask browser to authenticate with bogus authtype: 



GalleryUtilities::setResponseHeader('HTTP/1.0 401 Unauthorized', false);

GalleryUtilities::setResponseHeader('WWW-Authenticate: Bogus', false);



    * Redirect with random username and password. This won't actually clear the browser's authentication cache but will replace it with an invalid username and password. Since Gallery ignores invalid HTTP auth credentials, this effectively logs the user out. 



    * Clear Internet Explorer's authentication cache with JavaScript:



 try {ldelim}

   {* http://msdn.microsoft.com/workshop/author

/dhtml/reference/constants/clearauthenticationcache.asp *}

   document.execCommand("ClearAuthenticationCache");

 {rdelim} catch (exception) {ldelim}

 {rdelim}



The TryLogout page redirects to the FinishLogout page for two resons:



   1. To replace the browser's authentication cache with an invalid username and password

   2. To check that the user was indeed logged out. If the user was logged out, the FinishLogout page redirects back to the Gallery application. Otherwise it displays a warning advising the user to manually clear their authentication cache (Clear Private Data in Firefox).



The TryLogout page redirects to the FinishLogout page using JavaScript and falls back on a manual link. It can't use a 302 Found status because the page needs to load for the Internet Explorer JavaScript to execute and because we can't put an invalid username and password in a Location: header.



http://codex.gallery2.org/Gallery2:Modules:httpauth
<< Back to user notes page