How to logout of an HTTP authentication (htaccess) that works in Google Chrome?

.htaccess google-chrome http-authentication
user983213 picture user983213 · Oct 7, 2011 · Viewed 13.3k times · Source

I got a solution for Firefox and IE but I didn't find any solution for Google Chrome.

Is there a way to do it in Google Chrome?

Answer

Gyula Soós picture Gyula Soós · Mar 23, 2016

I know it's a really old post... I mean like friggin 5 years now, but I just found a somewhat good solution.

Inside your protected folder, create another folder, let's call it "logout". Place the same .htaccess file in here as you have in your protected folder, except with a small modification. instead of:

Require valid-user

now write:

Require user EXIT

And make sure, you don't have a user named exit! :D

In your protected area, your logout link or button or whatever, should redirect the user to this address: example.com/protectedFolder/logout

The browsers usually are able to keep only one user logged in from one site name or realm name... the sign in attempt for the user Exit will overwrite everything, thus the originally logged in user, would have to log in again to the protected area.

But as always, I might be wrong, and you should still close all your browser window, and restart the computer if you want to be sure! :) Also, it wouldn't hurt, if you would tell your users what is going to happen, when they hit logout!

I have tested this in chrome and in internet explorer 11.(will not work in edge, and maybe others neither) The solution was found here: https://www.mavensecurity.com/media/BasicAuthLogOut.pdf

Related questions

How to send compressed (deflated) SVG via Apache2?

I have specified the following attributes in my site's .htaccess file: AddOutputFilterByType DEFLATE image/svg+xml DeflateCompressionLevel 9 Header append Vary Accept-Encoding However, my SVG asset is not being sent in compressed form: $ curl https://example.org/assets/svg/asset.svg …

Read More
Access-Control-Allow-Origin Multiple Origin Domains?

Is there a way to allow multiple cross-domains using the Access-Control-Allow-Origin header? I'm aware of the *, but it is too open. I really want to allow just a couple domains. As an example, something like this: Access-Control-Allow-Origin: http://domain1.example, …

Read More
How to redirect all HTTP requests to HTTPS

I'm trying to redirect all insecure HTTP requests on my site (e.g. http://www.example.com) to HTTPS (https://www.example.com). I'm using PHP btw. Can I do this in .htaccess?

Read More