As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP Authentication.
Currently I'm sending an HTTP 401 to do so like this:
<?php header('HTTP/1.1 401 Unauthorized', true, 401); exit;
And upon subsequent requests, I'm prompted by the browser with the credentials modal. Upon clicking Cancel, I receive an HTTP 401 response, the intended result.
This is an internal application and HTTPS is used.
Are there any potential security issues with this? I'm using the LDAP module (hence the Basic HTTP Authentication). Does Apache "cache" the credentials in any manner or are the credentials verified with each request from the user-agent? Is there anything else I need to do to ensure that requests without valid credentials from the user-agent always receive an HTTP 401 response?