且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

PHP Digest身份验证,注销

更新时间:2023-12-02 11:36:16

取消设置$ _SERVER ['PHP_AUTH_DIGEST']将无效.问题是,对于您设置的任务并没有真正的好"答案.

Unsetting $_SERVER['PHP_AUTH_DIGEST'] will have no effect. The problem is, there's not really a "good" answer to the task you've set.

HTTP规范在技术上不允许这样做,但是实际上,如果您向其他浏览器发送另一个401,则其中的大多数浏览器都会有效地注销用户".每个php.net/http-auth:>

The HTTP specification doesn't technically allow for it, but in practice, most of the browsers out there will effectively "log the user out" if you send them another 401. Per php.net/http-auth:

在收到服务器响应401时,Netscape Navigator和Internet Explorer都将清除该域的本地浏览器窗口的身份验证缓存.这可以有效地注销"用户,迫使他们重新输入用户名和密码.某些人使用它来超时"登录或提供注销"按钮.

Both Netscape Navigator and Internet Explorer will clear the local browser window's authentication cache for the realm upon receiving a server response of 401. This can effectively "log out" a user, forcing them to re-enter their username and password. Some people use this to "time out" logins, or provide a "log-out" button.

在您的代码中,最简单的方法可能类似于:

From your code, the simplest method is probably something like:

function logout(){
    header('HTTP/1.1 401 Unauthorized');
    return true;
}

但是,同样,这实际上并不是HTTP规范所认可的.

but, again, this is not actually something approved of by the HTTP specification.