Is there a browser equivalent to IE’s ClearAuthenticationCache?

by

I’ve come up with a fix that seems fairly consistent but is hacky and I’m still not happy with it.

It does work though 🙂

1) Redirect them to a Logoff page

2) On that page fire a script to ajax load another page with dummy credentials (sample in jQuery):

$j.ajax({
    url: '<%:Url.Action("LogOff401", new { id = random })%>',
    type: 'POST',
    username: '<%:random%>',
    password: '<%:random%>',
    success: function () { alert('logged off'); }
});

3) That should always return 401 the first time (to force the new credentials to be passed) and then only accept the dummy credentials (sample in MVC):

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult LogOff401(string id)
{
    // if we've been passed HTTP authorisation
    string httpAuth = this.Request.Headers["Authorization"];
    if (!string.IsNullOrEmpty(httpAuth) &&
        httpAuth.StartsWith("basic", StringComparison.OrdinalIgnoreCase))
    {
        // build the string we expect - don't allow regular users to pass
        byte[] enc = Encoding.UTF8.GetBytes(id + ':' + id);
        string expected = "basic " + Convert.ToBase64String(enc);

        if (string.Equals(httpAuth, expected, StringComparison.OrdinalIgnoreCase))
        {
            return Content("You are logged out.");
        }
    }

    // return a request for an HTTP basic auth token, this will cause XmlHttp to pass the new header
    this.Response.StatusCode = 401; 
    this.Response.StatusDescription = "Unauthorized";
    this.Response.AppendHeader("WWW-Authenticate", "basic realm=\"My Realm\""); 

    return Content("Force AJAX component to sent header");
}

4) Now the random string credentials have been accepted and cached by the browser instead. When they visit another page it will try to use them, fail, and then prompt for the right ones.

More Related Contents:

  1. Asp.Net Forms Authentication when using iPhone UIWebView
  2. Adding ASP.NET MVC5 Identity Authentication to an existing project
  3. What is default hash algorithm that ASP.NET membership uses?
  4. How do I protect static files with ASP.NET form authentication on IIS 7.5?
  5. MVC 5 Access Claims Identity User Data
  6. Store/assign roles of authenticated users
  7. asp.net cookies, authentication and session timeouts
  8. Allow anonymous authentication for a single folder in web.config?
  9. Web authentication state – Session vs Cookie?
  10. Deploying website: 500 – Internal server error
  11. Response.Redirect with POST instead of Get?
  12. Advantage of creating a generic repository vs. specific repository for each object?
  13. TLS 1.2 in .NET Framework 4.0
  14. Why does the CheckBoxFor render an additional input tag, and how can I get the value using the FormCollection?
  15. bytearray to image asp.net
  16. ASP.NET page life cycle explanation
  17. CORS support for PUT and DELETE with ASP.NET Web API
  18. ASP.NET: HTTP Error 500.19 – Internal Server Error 0x8007000d
  19. How to deploy an ASP.NET Application with zero downtime
  20. Return PDF to the Browser using ASP.NET Core
  21. Is it a good practice to avoid using Session State in ASP.NET MVC? If yes, why and how?
  22. ASP.NET Push Redirect on Session Timeout
  23. Accessing parent data in nested repeater, in the HeaderTemplate
  24. Access Web.config settings in Asp.Net Core App?
  25. Which control caused the postback?
  26. How do I Configure IIS to accept POST requests?
  27. Detect from browser if specific application is installed
  28. What do the TargetFramework settings mean in web.config in ASP .NET MVC?
  29. C# ASP.NET Send Email via TLS
  30. Could not load type ‘site._Default’ [closed]

Leave a Comment