9

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP Authentication.

Currently I'm sending an HTTP 401 to do so like this:

GET logout.php

<?php
header('HTTP/1.1 401 Unauthorized', true, 401);
exit;

And upon subsequent requests, I'm prompted by the browser with the credentials modal. Upon clicking Cancel, I receive an HTTP 401 response, the intended result.

This is an internal application and HTTPS is used.

Are there any potential security issues with this? I'm using the LDAP module (hence the Basic HTTP Authentication). Does Apache "cache" the credentials in any manner or are the credentials verified with each request from the user-agent? Is there anything else I need to do to ensure that requests without valid credentials from the user-agent always receive an HTTP 401 response?

1 Answer 1

7

Basic auth credentials are transmitted with each and every request by the browser. Hence why you cannot traditionally "log out" without closing the browser.

The reason why this approach works is because the browser is stateless. Normally when it sends a GET/POST/HEAD request it receives a 200 OK response. If it receives a 401 response it will prompt the user for credentials and resubmit the request with these credentials. If those credentials are wrong the server will again send a 401 response and the browser again prompts. So when the browser receives a 401 response it assumes the credentials sent in the prevoius request were wrong and will ask again.

It is important to remember that you are relying on client side behaviour to clear the credentials and ask for new ones from the user and as such there is always a risk associated with something outside of your control.

2
  • the hard bit is organising it so that they can log back in - perhaps set a server-side session value and redirect to a page that if it sees the session value serves the 401 response and clears the session value. else allows log-in. that way a resubmission with correct credentials can log in,
    – Jasen
    Jun 16, 2015 at 1:03
  • If you're using server side session there is no reason to use basic auth over say forms based authentication, JWT or any other authentication scheme.
    – wireghoul
    Mar 11, 2021 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .