Logging out of Basic HTTP Authentication

Question

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP Authentication.

Currently I'm sending an HTTP 401 to do so like this:

GET logout.php

<?php
header('HTTP/1.1 401 Unauthorized', true, 401);
exit;

And upon subsequent requests, I'm prompted by the browser with the credentials modal. Upon clicking Cancel, I receive an HTTP 401 response, the intended result.

This is an internal application and HTTPS is used.

Are there any potential security issues with this? I'm using the LDAP module (hence the Basic HTTP Authentication). Does Apache "cache" the credentials in any manner or are the credentials verified with each request from the user-agent? Is there anything else I need to do to ensure that requests without valid credentials from the user-agent always receive an HTTP 401 response?

Answer 1

Basic auth credentials are transmitted with each and every request by the browser. Hence why you cannot traditionally "log out" without closing the browser.

The reason why this approach works is because the browser is stateless. Normally when it sends a GET/POST/HEAD request it receives a 200 OK response. If it receives a 401 response it will prompt the user for credentials and resubmit the request with these credentials. If those credentials are wrong the server will again send a 401 response and the browser again prompts. So when the browser receives a 401 response it assumes the credentials sent in the prevoius request were wrong and will ask again.

It is important to remember that you are relying on client side behaviour to clear the credentials and ask for new ones from the user and as such there is always a risk associated with something outside of your control.