HTTP Authentication Logout

yendor

Here's my senario.

I have some pages that require authentication via the WWW-Authenticate header. I know that once users authenticate themselves for a paticular realm, their login is good for every page in that relam. My question is; Is there a way for them to "log out" without having to close the browser. I tried:

unset ($PHP_AUTH_USER);
unset ($PHP_AUTH_PW);

It doesn't work. When I go to a page in that same realm it doesn't request authentication. It shows the login as the same user. May be I should of used sessions?

thanks in advance

herve

Why do you want them to "log out" ?

Anon

the only way for a true logout is for the user to close the browser.

[deleted]

There is only one way to log users out, and it's not pretty.

You have to re-send the authentication headers. Basically you ask them to re-enter their username and password. If they don't , and they press cancel, then the user will be 'logged out'.

Not pretty.

yendor

That's ok! Some user was complaining about having to close their browser before a new user could log in. When I showed them they can open a new browser(with their old one still open) they are prompted to log in again, they accepted this.

Thanks

Rodney

lentin64

reset($PHP_AUTH_USER);
reset($PHP_AUTH_PW);

[deleted]

I think you are missing two points here :-)

point one:

reset
(PHP 3, PHP 4 >= 4.0.0)

reset -- Set the internal pointer of an array to its first element

and point two, he already tried to erase those vars, and that doesn't work (because they are read-only, generated before the script starts, and destroyed after the script ends)

Anon

if it is not a matter of logout but of a login with different credentials it can be solved like this:

if (trim($auth_username)!=$AUTH_USER) {
$target = "https://mydomain/page.php";
$msg = "<meta http-equiv=\"Refresh\" content=\"0;url=$target\">";
echo $msg;
exit;
}
if (trim($auth_username)==$AUTH_USER) {
header("status: 401 Not Found");
}

if a user is addressing this page with the currently logged in user as query string, then he can authenticate with his own credentials. In this Version the new loginname must be different from the old one, but it is possible to re-authenticate with every loginname with a little more effort.