HTTP authentication logout via PHP

by

Mu. No correct way exists, not even one that’s consistent across browsers.

This is a problem that comes from the HTTP specification (section 15.6):

Existing HTTP clients and user agents typically retain authentication
information indefinitely. HTTP/1.1. does not provide a method for a
server to direct clients to discard these cached credentials.

On the other hand, section 10.4.2 says:

If the request already included Authorization credentials, then the 401
response indicates that authorization has been refused for those
credentials. If the 401 response contains the same challenge as the
prior response, and the user agent has already attempted
authentication at least once, then the user SHOULD be presented the
entity that was given in the response, since that entity might
include relevant diagnostic information.

In other words, you may be able to show the login box again (as @Karsten says), but the browser doesn’t have to honor your request – so don’t depend on this (mis)feature too much.

More Related Contents:

  1. How to properly use Bearer tokens?
  2. Htaccess blog slug Rewrite does not work
  3. Undefined index $_POST
  4. Why would one omit the close tag?
  5. Using .htaccess to make all .html pages to run as .php files?
  6. How should I choose an authentication library for CodeIgniter? [closed]
  7. How Can I Remove “public/index.php” in the URL Generated Laravel?
  8. Cross domain cookies
  9. Disable PHP in directory (including all sub-directories) with .htaccess
  10. No input file specified
  11. Is it possible to redirect post data?
  12. Remove .php extension (explicitly written) for friendly URL [closed]
  13. Getting a 500 Internal Server Error (require() failed opening required path) on Laravel 5+ Ubuntu 14.04
  14. How to send 500 Internal Server Error error from a PHP script
  15. Logging In To Joomla 1.5 Using External Form (not within joomla folder, but on same server)
  16. When do I have to declare session_start();?
  17. Process HTML files like PHP
  18. mod_rewrite, php and the .htaccess file
  19. PHP – Secure member-only pages with a login system
  20. Prevent Browser’s Back Button Login After Logout in Laravel 5
  21. Class ‘App\Http\Controllers\admin\Auth’ not found in Laravel 5
  22. Laravel – How to get current user in AppServiceProvider
  23. Get “Content-Type” header of request in PHP
  24. PHP form token usage and handling
  25. .htaccess mod_rewrite > 500 Internal Server Error
  26. Removing X-Powered-By
  27. Laravel Auth:attempt() will not persist login
  28. Limiting user login attempts in PHP [duplicate]
  29. Avoid public folder of laravel and open directly the root in web server
  30. Content-length and other HTTP headers?

Leave a Comment