Clear SSL client certificate state from JavaScript

caching ssl certificate client-certificates
RicardoSBA picture RicardoSBA · Mar 15, 2012 · Viewed 13.4k times · Source

I'm using client certificates in SSL sessions to authenticate users, but I'm having a bit of a problem with cached sessions. (I have configured IIS to accept—not require—client certificates.)

Normal situation:
A user accesses the page that asks for the certificate. The browser launches the certificate selector, the user selects the desired certificate (and enters a PIN if needed), and everything goes forward as it should.

Situation where things don't work as expected:
A user accesses the page that asks for the certificate. The browser launches the certificate selector, and the user selects the desired certificate, but then cancels at the PIN dialog. The user is redirected to the previous page because no certificate was sent. The user tries to log in again, but the attempt automatically fails because the last SSL session was cached.

I solved this in IE using document.execCommand("ClearAuthenticationCache");, but it still doesn't work in FF or Chrome because they don't support the method. Is there any way to solve this?

Answer

Bruno picture Bruno · Mar 15, 2012

You may be interested in this discussion and this Chromium issue. In particular, you should try:

if (window.crypto) window.crypto.logout();

Related questions

How do we control web page caching, across all browsers?

Our investigations have shown us that not all browsers respect the HTTP cache directives in a uniform manner. For security reasons we do not want certain pages in our application to be cached, ever, by the web browser. This must …

Read More
Using <meta> tags to turn off caching in all browsers?

I read that when you don't have access to the web server's headers you can turn off the cache using: <meta http-equiv="Cache-Control" content="no-store" /> But I also read that this doesn't work in some versions of IE. …

Read More
Disabling Chrome cache for website development

I am modifying a site's appearance (CSS modifications) but can't see the result on Chrome because of annoying persistent cache. I tried Shift+refresh but it doesn't work. How can I disable the cache temporarily or refresh the page in …

Read More