Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Better "logout" support by sending a 401 response after logout #7

Open
agwells opened this issue May 8, 2018 · 0 comments
Open

Better "logout" support by sending a 401 response after logout #7

agwells opened this issue May 8, 2018 · 0 comments

Comments

@agwells
Copy link
Member

agwells commented May 8, 2018

As mentioned in the README, browsers tend to cache successful HTTP auth credentials indefinitely, which makes it difficult to really "log out" if you're a human being using this plugin.

However, testing in FF and Chrome indicates that they will clear cached credentials, if they receive a 401 response to those creds. So, for use cases where people might want to use this plugin to authenticate human beings into a site, it would be useful to have the option of sending a 401 response after the user logs out.

(Another method to clear the cached credentials, is to put an invalid username in the URL with @, e.g. https://nosuchuser@moodle.example.com . This will also cause the browser to forget existing, previously-successful HTTP auth credentials for that domain. But this can cause some weird edge case behavior in the UI on page refreshes and such.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant