Home/ Questions/Q 171373
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T12:58:35+00:00

I have the restful_authentication plugin installed in a rails app, with a sessions_controller that

  • 0

I have the restful_authentication plugin installed in a rails app, with a sessions_controller that has a destroy method like this:

def destroy   self.current_user.forget_me if logged_in?   cookies.delete :auth_token   reset_session   flash[:notice] = 'You have been logged out.'   redirect_back_or_default('/') end

In the application controller I have:

before_filter :login_required

And In the sessions_controller I have:

skip_before_filter :login_required

My problem is that when a user authenticates with http basic authentication, he/she is not logged out. the session is destroyed, but the user is able to navigate to restricted pages with no problem. This problem does not occur with session authentication through the plugin. How can I make this method get rid of the basic authenication?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Nothing can be done server-side to ‘logout’ a user in this situation. When the user logs in through basic authentication, the browser stores the authentication information, and sends the authentication parameters through the http headers with every request. if the user logs in with basic auth, he/she will have to close his/her browser window to logout.

    • 0