I'm securing an area of a clients website with .htaccess and an SSL.

 

As it's clear that it's not possible to create a logout function does anyone know the default timeout times for the following:

 

How long does it keep you logged in for after closing the browser?

How long does it keep you logged in for during periods of inactivity on a page?

 

I have tried to do a few tests this evening and thought it was around 40 seconds after closing the browser but it seemed a bit irregular. I'm still testing the inactivity side of it but as it's late I'm now off to bed so thought I would drop a quick post on here incase anyone can answer it by the morning. I have only tested it in chrome so far but has anyone else tested this in other browsers or know a definitive answer.

 

Cheers!

I've always found this a pian and ass personally and nowadays, only use this to protect test areas whilst a client is signing off a site. For anything that requires logins use a script based approach. For logging out, I'll paste in a quote from the Apache site:

 

 

 

.. from http://httpd.apache.org/docs/1.3/howto/auth.html

 

I know in Firefox you can clear these saved http auth login details via the webdeveloper plugin, but a normal user wouldn't want to this - they'd expect a simple "log out" link.

 

Apparently in Firefox, you can send users to http://logout@yourserver.example.com/

 

There are some further solutions at http://computerstuff.jdarx.info/content/inadequate-logout-functionality-http-authentication

 

However, keep it simple, use script based auth using PHP - loads of composer packages that all for this easily. Any decent PHP framework will make light work of basic user managaement too.

 

Thanks for the help. I have hit a small hitch though. I now have php login script tgo enable me to setup a logout feature for the secure area of the website, I set all the pages to only show if there was an active session and renamed the site files from .html to .php within the secure area. It now strips out all the HTML from the page. It still appears to be OK as all the text is fairly generic. I do however use pagelime for my CMS and it needs the HTML to know which bits can be edited. How can I allow php to allow HTML through and what are the pitfalls?

I found this morning it could be because of the SSL.......It shows that it is blocking content. I can obviously correct this by adding it to trusted sites. Anyone know any other ways as I don't want to have to put a notice stating that the site needs to be added to trusted sites?