Hi Todd,
Trying to logoff using Basic Auth is becoming something of a faq...
if there was a means by which i could strip out the Authorization
header in the client request, this would force a 401 response from
the server which would also satisfy my specific need.
I doubt if this will work. I suspect you want to strip this out when
the user does his logout-request (ie. a request for .../logout.html).
If you do this, the browser should present a popup-box to the user,
which he most probably would cancel. However, most browsers seem to
recollect their authorisation information they used before. Thus, as
soon as the user gets to a page that requests a login, the browser
tries with the user credentials that were kept and a popup is never
shown.
As someone already suggested: use a Cookie based algorithem. The
cookie gives you the opportunity to follow the status of the
user and effectively log him out. Another approach I once saw was
the use of a dedicated realm for that user. In stead of using a fixed
realm (ie. security domain) the domain is on a per session basis.
You should still fix the session someway (using the uri or a cookie),
but you can still stick with the 'Basic Auth' mechanism.
Hope this helps.
--Frank
