120092 - [RFE] "Logoff" from a basic authenticated realm

Status: VERIFIED DUPLICATE of bug 55181

(Core :: Networking: HTTP, enhancement)

Description

[timtas]

Hi

As I understand basic authentication, if a server responds to a request with
code 401 and a header:

WWW-Authenticate: basic realm="any_given_realm"

the browser will ask for userid/password and store it in his memory together
with the realm and the host (and the URL path for convenience). This information
is kept until the user closes the browser, giving him:
- no chance to log in using a different account
- no chance to logoff so he may leave his computer to go to the toilet

without having to close the browser.

As I understand the mechanism, it should not be difficult to implement a Logoff
and it would be a major convenience for users. I think of a list of currently
"active " basic authenticated sessions and if the users chooses to logoff, the
cached authentication information would just be dropped. All the necessary data
seems to be stored already in the browser anyway.

Bye
Tim

Comment 1

[timeless]

this is already reported. I'm hoping it's reported in psm (however it might be 
in UID).

Comment 2

[Stephane Saux]

I don't think this is PSM. There's no crypto involved.

Over to browser->security/general

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Over to Networking:HTTP for basic-auth issues. Confirming - this is a valid RFE.

Comment 4

[Matthias Versen [:Matti]]

*** This bug has been marked as a duplicate of 55181 ***

Comment 5

[Boris Zbarsky [:bzbarsky]]

verified