Re: HTTP authentication and session timeout

Hmm. Perhaps I wasn't clear.

You are correct, the browser sends the auth string. That's what I get for sending email prior to the first cup of coffee.

In perl (CGI), try this:
#!/usr/local/bin/perl
$url = "http://loggedout:blank@the.current.url"; print "Location: $url \n\n";

or in php try this:
<?php header( 'Location: http://loggedout:blank@the.current.url' ); ?>

or in asp try this:
<% Response.Redirect "http://loggedout:blank@the.current.url" %>

• Original Message ----- From: "Jason Coombs" <jasonc@science.org> To: "Craig Skelton" <craig@craigskelton.com>; <webappsec@securityfocus.com>; "'UDP 53'" <udp53@hotmail.com> Sent: Monday, November 25, 2002 11:53 AM Subject: RE: HTTP authentication and session timeout

> Re-read RFC 2617
instead
> by all browsers while Realm is merely eye candy for the end-user.
base64
> encoded pair. From the server side, you can override the current auth
Received on Tue Nov 26 04:15:44 2002