Hacker News Reader

Comment by ithkuil | Hacker News Reader

How do you logout?

Send an ajax request to your api with invalid credentials. The response returns a 401 and loggs the user out. Then redirect to the pre-login page.

if all the client needs is to see a 401, can't you just make a static /logout page that always renders a 401?

With Firefox, from the Preferences, select only "Active logins" in the Clear History dialog [1]. Very odd that it belongs to history and far from ideal. However it's not something a lot of people use nowadays so I'm not surprised that they tucked it under the carpet.

I use Basic Authentication for a few web services running on a server of mine and that I'm the only user of. It saves me a lot of work. I set the user and password in a file on the server and let nginx deal with it.

[1] https://security.stackexchange.com/questions/192828/firefox-...

Last time I used HTTP basic auth, we've had a page which would unconditionally send 401 error code -- it'd invalidate credentials cache (effectively logging out the user) and then pop up new credentials dialog. I am not sure how standard-complaint this was, but it seemed to work in most browsers.

One downside is that in trivial implementation (/logout page returning 401), you'll end up with credential prompt where no credentials work, and this can be pretty confusing if someone leaves the compute in that state. I think it can be worked around with "expiration" URL parameter or a cookie, but this is somewhat finicky to setup.

While your point is correct: It's not design with a logout in mind, but you can do it. For instance clicking link that will send invalid credentials, that will return a 401 and work like a logout.

Mostly I just close my browser, that clear everything in my setup.

I don't see anything wrong with a convention "to log out, close your browser" especially for little internal utility pages.

People could have many open tabs with work in them. Maybe they would have to login again in some of them. Other could come back in a different state, especially with SPA.

Great question. This is a downside, there is no built-in method, but there are some tricks. If I remember correctly you can send headers with incorrect credentials. I’ll have to do some research and add that to my template.

If I remember this correctly, you send a request with incorrect credentials either via javascript, or by sending the user to a "/logout"-endpoint where you disallow any authentication credentials, causing the browser to prompt the user for a new username and password. This not great in terms of UX and depending on something implicit for something as important as logging out does not seem great for security.

Why browsers do not have better functionality built in for authentication is something that's always been a bit baffling...

You can still apply a session id to the client and destroy the session after the user clicked on logout…

I'm storing sessions now? jesus what a disaster.

Reply on news.ycombinator.com