546732 - Allow advanced users a quick way to clear HTTP authenticated sessions

Status: NEW

(DevTools :: General, defect, P5)

Description

[Mike Beltzner [:beltzner, not reading bugmail]]

In bug 544846 we collapsed clearing HTTP authenticated sessions and cookies together into a single item, on the basis that for most users clearing cookies will have the effect of logging them out of cookie-authenticated sites, and so we should do the same for HTTP authenticated sites. I stand by this decision and believe it was the right choice to do for the majority of users.

Reed and others point out, however, that for IT administrators and web developers, clearing just HTTP authenticated sessions is useful functionality. When we build our developer tool suite, we should reinstate this function in convenient button form. Ehsan's even provided the code:

Components.classes["@mozilla.org/security/sdr;1"].getService(Components.interfaces.nsISecretDecoderRing).logoutAndTearDown();Components.classes["@mozilla.org/observer-service;1"].getService(Components.interfaces.nsIObserverService).notifyObservers(null,
"net:clear-active-logins", null);

Comment 1

[Rob Campbell [:rc] (:robcee)]

we'll need a place to put this (and other actions similar to it).

The console seems like a likely place to hide extra developer functions and should be reasonably quick to access without polluting regular users' UI.

Comment 2

[(no longer active)]

Do we want to drag the console further away from its supposed purpose, being an error console?

Comment 3

[Rob Campbell [:rc] (:robcee)]

I was referring to the activity console described in wiki.mo/Firefox/Projects/Console

Comment 4

[(no longer active)]

OK, I stand corrected.

Comment 5

[Eric Jung [:ericjung]]

(In reply to comment #0)

> Components.classes["@mozilla.org/security/sdr;1"].getService(Components.interfaces.nsISecretDecoderRing).logoutAndTearDown();Components.classes["@mozilla.org/observer-service;1"].getService(Components.interfaces.nsIObserverService).notifyObservers(null,
> "net:clear-active-logins", null);

FYI, that should logoutAndTeardown (notice the case difference). Also, that code doesn't clear HTTP proxy authentication credentials. For that, you need to do:

Cc['@mozilla.org/network/http-auth-manager;1'].
  getService(Ci.nsIHttpAuthManager).
  clearAll();

The code in comment 0 doesn't appear to be required if you only want to clear cached HTTP proxy authentication credentials. I don't claim understand the difference between that and "HTTP authenticated sessions". Anyone care to explain?

Comment 6

[Rob Campbell [:rc] (:robcee)]

This feels like it would be good to implement as a GCLI command.

Comment 7

[Nicolas Chevobbe [:nchevobbe]]

Not sure if we still want to have something like that (probably no since it's been 7 years without any activity)