HTTP Basic Auth logout

Question

My server is running Apache and I used .htaccess for my basic auth. However, I want my users be able to cancel the auth (log out) with a button. Is it possible and how to do that?

zappee · Accepted Answer · 2017-06-14T09:16:52.047

3

Basic Auth is not designed to manage log-out. If you would like to do it then you need to do the following:

1) Add a logout button to your page.

2) When user click on the log-out button send a blank username/password to the same URL as in case of normal log-in.

3) In the response you send back a “You have successfully logged out” page.

The original credentionals will be will overwriten with the empty (wrong) one.

Hope that it helps you.

edited Jun 14 '17 at 09:16

answered Jun 14 '17 at 05:51

zappee

20,148
14
73
129

It's already been answered almost 10 years ago here: https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication – Capsule Jun 14 '17 at 06:51

score 2 · Answer 2 · answered Jun 14 '17 at 05:43

2

First of all, HTTP does not provide logout: HTTP/1.1. spec

But! You can redirect user to: http://newuser@www.example.com/

answered Jun 14 '17 at 05:43

Tomasz Adamczyk

251
1
7

It's already been answered almost 10 years ago here: https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication – Capsule Jun 14 '17 at 06:51
Brilliant! I just edited the href of my existing Sign Out button to point to such an URL. – F. Santiago Sep 20 '18 at 13:18
1

N.B. redirection technique no longer works for Chrome 65+ – egerardus Nov 21 '19 at 03:46

HTTP Basic Auth logout

2 Answers2

Linked