Closing the browser window is the only real method to let a user log out from your application.
You're using HTTP Authentication, so userid and password are stored clientside in the header of the browser. On every interaction between browser and webserver the browser sends userid and password to the webserver.
The point is that you have to delete userid/pwd information clientside (browser). But this is impossible.
Work around:
The solution is not to let the user log out, the solution is to make a relogin with another user. Define a logout-user, call him "logout" with password "logout". This user is a dummy user without any rights.
To relogin with user "logout" the vistor has to send a request like "http://logout:logout@www.example.com]" to your server, so your server validates the uid:pwd combiniation and your server variables $PHP_AUTH_USER and $PHP_AUTH_PW are both set to "logout".
if ($logout) {
header("Location: http://logout:logout@www.example.com/");
exit;
}
But this work around only works in connection with IExplorer, but not with Netscape. 🙁
Netscape doesn't allow to unset userid/pwd header informations.
Please try all other possibilities you can find on the link weekender just posted.
