Logging users out with basic authentication?

Question

I've searched around and there doesn't seem to be a non-hacky way to clear the user credentials from the browser using basic authentication.

I'm building a WebAPI with an HTML client that accepts username/password - if the user logs in, they should certainly be able to log out as well, or the system should automatically log out after a certain time period.

Is there any standard way to accomplish this with Basic Auth (over SSL), or should I start looking into other forms of authentication?

Edit: looking into the SimpleMembershipProvider, would there be anything "wrong" with extending the Membership table with an "IsLoggedIn" property that I can toggle and check with every request? If they click logout, then I redirect to the login page and return 401 Unauthorized unless they submit their credentials again. Does this sound ok?

Badri Badri · Accepted Answer · 2013-04-12T19:23:45

No. Until the time the browser is closed, credentials are cached by the browser. There is no non-hacky way to clear the credentials. Check this out.

Logging users out with basic authentication?

1 Answers