Signing Out with Basic Authentication

Doesn’t it seem reasonable that if you can sign in somewhere, you should be able to sign out? If you use Basic Authentication (see RFC 2617), signing out becomes a nearly insurmountable problem.

The highs and lows of Basic Authentication

Basic Authentication works like this. When a resource requires authentication, the server responds to the browser with 401 Authentication Required. The browser asks the user for a username and password and sends them to the server. If authentication succeeds, the server returns the requested resource. Since HTTP is stateless, the same procedure applies to each request.

To spare the user from entering a username and password over and over, the browser “remembers” them after the first successful authentication and sends them automatically with each subsequent request. The details depend on the browser, but this is generally limited to the browser session, which starts when the browser opens and ends when it closes. The problem is that there’s no standard way to make the browser stop sending the credentials, which would in effect sign the user out.

A workaround that stopped working in Internet Explorer

The first approach takes advantage of the fact that the browser asks the user for new credentials when authentication fails. It also relies on credentials being allowed in the URL itself, in the form protocol://username:password@server, for example http://foo:hoo@acme.com/doSomething. The trick is to redirect on sign-out, adding credentials that don’t exist to the URL. That leaves the browser showing the sign-in dialog. Pavel Růžička describes the full procedure in Signing out of HTTP authentication.

It really did work, until Big Brother, excuse me, Microsoft, released cumulative security update MS04–004, also known as KB 834489 and included in SP2. That sent the ability to put credentials in URLs to the happy hunting grounds. Microsoft’s write-up gives the details: 
A security update is available that changes how Internet Explorer handles user information in HTTP and HTTPS URLs by default. After reading all the reasons for the patch, I have to say I wiped away a tear.

A workaround that works in Internet Explorer

Luckily, it wouldn’t be Internet Explorer without another way for its chosen users to sign out. ActiveX scripting lets us use the information in this Microsoft article: How To Clear Logon Credentials to Force Reauthentication. If we have someone who can compile the code, 
package it and sign the ActiveX component (thanks, NkD), we’re halfway there. All that’s left is the small matter of convincing users that enabling ActiveX isn’t the same as opening Pandora’s box…