RE: HTTP authentication and session timeout

Only real way to do this is to use a different URL (thus maintaining state) for each session, and use that url as the realm.

Then, if the realm (==url) changes, the browser will "forget" about the credentials, and prompt the user to reenter them.

MS has a kluge where they do this in outlook webmail, but it is highly browser dependent. IE prompts to be reauthenticated, but Mozilla and Konqueror don't, for example.

Rogan

> -----Original Message-----
> From: UDP 53 [mailto:udp53@hotmail.com]
> Sent: 25 November 2002 01:13
> To: webappsec@securityfocus.com
> Subject: HTTP authentication and session timeout
>
>
> I am looking at a web app which uses HTTP authentication
Received on Mon Nov 25 10:20:14 2002