4

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from the cert, a lookup is done and the user is logged in.

In the case of cert auth, if a user logs out; he can just log back in without manually resubmitting the certificate. The browser will do that for him automatically. I see this being a bit undesirable because the user thinks he's logged out but on clicking the URL subsequently, the user is just sent right through.

Is there anything we can do to make the browser to re-check the certificate submission with the user after a logout or for a specific event? We can't change browser settings because we can't go to all the end users and ask them to clear their ssl cache.

  • You mean Client side Certificates? – LvB Mar 7 '16 at 14:34
  • Yeah. An end user attempting to logon with his personal certificate. – dozer Mar 8 '16 at 7:37
2

Client side certificates are currently is a mostly enterprise used feature, And it relies heavily on the web-browser to manage when to send what certificate to the server (in mostly an ugly ui element).

So currently using a login only based on the certificate means you auto-login each time you use the certificate. (the browser remembers you want to use the certificate and re-uses it when you connect).

The only way to stop the browser from doing this is client-side. the user needs to 'tell' the browser to NOT send the certificate.

a different way to facilitate both certificate login and user/password login is by having 2 different login pages, one for password login, and one for certificate login. So a end user can choose what type of login he / she / it wants to use.

There is of course also the possibility to revoke the certificate the user has and require him/her/it obtain a new certificate to login. a revoked certificate would trigger the browser to give the user a "selection box" to submit a new certificate.

  • 2
    Thanks, so basically you're saying it's NOT possible to force the client's browser to stop sending the certificate again automatically from the server side. I've been thinking that too; I'll assume your answer if no one else has an other opinion. – dozer Mar 8 '16 at 10:07
  • Not during my test on this area (about 1 year ago ;) ) – LvB Mar 8 '16 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.