Break Apache's basic authentication

[jaybar]

We need a way to "break" the basic authentication, basically log a user out.
We have a 3rd party web-app which requires basic authentication. We (currently) use htaccess for access management.
A user that hits the site is prompted for user name and password and continutes throughout the site, but they can leave the site, return and later without re-authenticating as long as they don't close their browser.
I understand that the browser re-submits the information when they return (as this information is available in the header). We tried to flush out the server variable $PHP_AUTH_USER but that didn't work. Right now we get around the problem with cookies (setting and redirecting to another page) but it's not a "clean" solution.
Our environment is as follows:
HPUX11 n class HP -Apache1.3.20 -PHP4 -Oracle

 

[johnhoke]

a cleaner solution would be to not use basic authentication, but use some 3rd party security mechanism based on cookies with timeouts, there are many different approaches to this, and you are using PHP so you may want to look at phpbuilder.com (phpbuilder.net.. i forget...) and search for authentication.

Then you can get away from htaccess and use your Oracle DB for authentication

Or if you are looking for commercial packages, check out

http://www.siteminder.com,

http://www.opennetworks.com,

and others...

-John ---
John Hoke