4 ms·

How do you logout?

by ithkuil 5y ago

How do you logout?

sdze 5y ago
You can still apply a session id to the client and destroy the session after the user clicked on logout…
- bobkazamakis 5y ago
  I'm storing sessions now? jesus what a disaster.
codazoda 5y ago
Great question. This is a downside, there is no built-in method, but there are some tricks. If I remember correctly you can send headers with incorrect credentials. I’ll have to do some research and add that to my template.
- yosamino 5y ago
  If I remember this correctly, you send a request with incorrect credentials either via javascript, or by sending the user to a "/logout"-endpoint where you disallow any authentication credentials, causing the browser to prompt the user for a new username and password. This not great in terms of UX and depending on something implicit for something as important as logging out does not seem great for security. Why browsers do not have better functionality built in for authentication is something that's always been a bit baffling...
mrweasel 5y ago
While your point is correct: It's not design with a logout in mind, but you can do it. For instance clicking link that will send invalid credentials, that will return a 401 and work like a logout. Mostly I just close my browser, that clear everything in my setup.
- throwawayboise 5y ago
  I don't see anything wrong with a convention "to log out, close your browser" especially for little internal utility pages.
  - pmontra 5y ago
    People could have many open tabs with work in them. Maybe they would have to login again in some of them. Other could come back in a different state, especially with SPA.
deepersprout 5y ago
Send an ajax request to your api with invalid credentials. The response returns a 401 and loggs the user out. Then redirect to the pre-login page.
- zemo 5y ago
  if all the client needs is to see a 401, can't you just make a static /logout page that always renders a 401?
deleted 5y ago
[deleted]
theamk 5y ago
Last time I used HTTP basic auth, we've had a page which would unconditionally send 401 error code -- it'd invalidate credentials cache (effectively logging out the user) and then pop up new credentials dialog. I am not sure how standard-complaint this was, but it seemed to work in most browsers. One downside is that in trivial implementation (/logout page returning 401), you'll end up with credential prompt where no credentials work, and this can be pretty confusing if someone leaves the compute in that state. I think it can be worked around with "expiration" URL parameter or a cookie, but this is somewhat finicky to setup.
pmontra 5y ago
With Firefox, from the Preferences, select only "Active logins" in the Clear History dialog [1]. Very odd that it belongs to history and far from ideal. However it's not something a lot of people use nowadays so I'm not surprised that they tucked it under the carpet. I use Basic Authentication for a few web services running on a server of mine and that I'm the only user of. It saves me a lot of work. I set the user and password in a file on the server and let nginx deal with it. [1] https://security.stackexchange.com/questions/192828/firefox-not-deleting-http-basic-authentication-credentials-although-being-instru/214062#214062 https://security.stackexchange.com/questions/192828/firefox-...

How do you logout?

sdze 5y ago

You can still apply a session id to the client and destroy the session after the user clicked on logout…

bobkazamakis 5y ago
I'm storing sessions now? jesus what a disaster.

codazoda 5y ago

Great question. This is a downside, there is no built-in method, but there are some tricks. If I remember correctly you can send headers with incorrect credentials. I’ll have to do some research and add that to my template.

yosamino 5y ago
If I remember this correctly, you send a request with incorrect credentials either via javascript, or by sending the user to a "/logout"-endpoint where you disallow any authentication credentials, causing the browser to prompt the user for a new username and password. This not great in terms of UX and depending on something implicit for something as important as logging out does not seem great for security. Why browsers do not have better functionality built in for authentication is something that's always been a bit baffling...

mrweasel 5y ago

While your point is correct: It's not design with a logout in mind, but you can do it. For instance clicking link that will send invalid credentials, that will return a 401 and work like a logout. Mostly I just close my browser, that clear everything in my setup.

throwawayboise 5y ago
I don't see anything wrong with a convention "to log out, close your browser" especially for little internal utility pages.
- pmontra 5y ago
  People could have many open tabs with work in them. Maybe they would have to login again in some of them. Other could come back in a different state, especially with SPA.

deepersprout 5y ago

Send an ajax request to your api with invalid credentials. The response returns a 401 and loggs the user out. Then redirect to the pre-login page.

zemo 5y ago
if all the client needs is to see a 401, can't you just make a static /logout page that always renders a 401?

deleted 5y ago

[deleted]

theamk 5y ago

Last time I used HTTP basic auth, we've had a page which would unconditionally send 401 error code -- it'd invalidate credentials cache (effectively logging out the user) and then pop up new credentials dialog. I am not sure how standard-complaint this was, but it seemed to work in most browsers. One downside is that in trivial implementation (/logout page returning 401), you'll end up with credential prompt where no credentials work, and this can be pretty confusing if someone leaves the compute in that state. I think it can be worked around with "expiration" URL parameter or a cookie, but this is somewhat finicky to setup.

pmontra 5y ago

With Firefox, from the Preferences, select only "Active logins" in the Clear History dialog [1]. Very odd that it belongs to history and far from ideal. However it's not something a lot of people use nowadays so I'm not surprised that they tucked it under the carpet. I use Basic Authentication for a few web services running on a server of mine and that I'm the only user of. It saves me a lot of work. I set the user and password in a file on the server and let nginx deal with it. [1] https://security.stackexchange.com/questions/192828/firefox-not-deleting-http-basic-authentication-credentials-although-being-instru/214062#214062 https://security.stackexchange.com/questions/192828/firefox-...