Servlet 3.0 logout doesn't work

Question

I've got a problem with the authentication features of Servlet 3.0:

With this code in a Servlet v3:

log.info(""+request.getUserPrincipal());
log.info(""+request.getAuthType());
log.info("===^===");
request.logout() ;
log.info(""+request.getUserPrincipal());
log.info(""+request.getAuthType());
request.authenticate(response) ;
log.info("===v===");
log.info(""+request.getUserPrincipal());
log.info(""+request.getAuthType());

I would always expect to see the Username/login windows, because of the logout() function. Instead, it seems to be a 'cache' mechanism which repopulate the credential and cancel my logout ...

Admin

BASIC

===^===

null

null

===v===

Admin

BASIC

Is it a problem with my firefox, or something I'm missing in the Servlet code?

Answer 1

I would always expect to see the Username/login windows, because of the logout() function. Instead, it seems to be a 'cache' mechanism which repopulate the credential and cancel my logout ...

That's the way HTTP BASIC AUTH was designed, it allows all authenticate state to be kept in the client. In other words, its impossible to logout with basic/digest authentication, the server cannot stop a client from caching and resending a BASIC auth authenticator on subsequent requests to the server.

My suggestion is to use form based authentication and the login method of HTTPServletRequest.

References

• New Security Features in Glassfish v3 (Java EE 6) - Part II
• New Security Features in Glassfish v3 (Java EE 6) - Part III
• Easiest and most portable way to authenticate programatically
• How to log users out from Glassfish server - need help from SUN

Answer 2

It's neither. Once logged in, the browser will always pass your user id and password to the url. Until you restart your browser. As far as I know each browser does that. And as far as I know there's currently no way to tell the browser to forget about the credentials.

However, you'll see your session will be different once you logged out. The usual solution is to add a variable of some kind to the session. Say "loggedin". If this variable is missing you know the user has to log in first and you'll redirect to say login.jsp. And once the user passed this jsp you set this variable again.

Using filters you can enforce this system-wide.