How to logout of an HTTP authentication (htaccess) that works in Google Chrome?

Question

I got a solution for Firefox and IE but I didn't find any solution for Google Chrome.

Is there a way to do it in Google Chrome?

Endothermic

Do you want to log a user out from a web app you control or logout as a user yourself? – Holohedral

i only want to logout the user of a http authentication(htaccess), i'm using php to do it, i'm doing this authentication with htaccess file, i found a solution for logout that works in ff and ie but i couldn't find anything to log out the user in chrome, i rly need to make it works in ff,ie and chrome. – Endothermic

If you just want to log yourself out, this worked for me: #4163622 – Stride

Answer 1

I know it's a really old post... I mean like friggin 5 years now, but I just found a somewhat good solution.

Inside your protected folder, create another folder, let's call it "logout". Place the same .htaccess file in here as you have in your protected folder, except with a small modification. instead of:

Require valid-user

now write:

Require user EXIT

And make sure, you don't have a user named exit! :D

In your protected area, your logout link or button or whatever, should redirect the user to this address: example.com/protectedFolder/logout

The browsers usually are able to keep only one user logged in from one site name or realm name... the sign in attempt for the user Exit will overwrite everything, thus the originally logged in user, would have to log in again to the protected area.

But as always, I might be wrong, and you should still close all your browser window, and restart the computer if you want to be sure! :) Also, it wouldn't hurt, if you would tell your users what is going to happen, when they hit logout!

I have tested this in chrome and in internet explorer 11.(will not work in edge, and maybe others neither) The solution was found here: https://www.mavensecurity.com/media/BasicAuthLogOut.pdf

Chromatograph

Thank you, very helpful! – Suffolk

Answer 2

You can't logout a HTTP authenticated session other then closing the browser window. Also see the accepted answer on this question for an extensive explanation.

Eisenberg

Answer 3

try redirect to:

wrong_user:[email protected]

Goffer

Answer 4

I have put together the following article which explains how I have managed to achieve this in Chrome. I hope this helps. https://www.hattonwebsolutions.co.uk/articles/how_to_logout_of_http_sessions

In short - you create a sub folder (as per Gyula's answer) but then send an ajax request to the page (which fails) and then trigger a timeout redirect to the logged out page. This avoids having a secondary popup in the logout folder requesting another username (which would confuse users). My article uses Jquery but it should be possible to avoid this.

Sapro