IE and Opera Don't Log Out

I tried this hack and it does seam to work. By changing the realm for IE and Opera the PHP_AUTH variables or cleared. This type of workaround would make the user defined Authentication realm feature pointless. Maybe we should look at modifying this workaround so that it adds a suffix to the realm. Its not ideal but maybe a good enough workaround for the time being. Until we find a better solution.

Here is how I implemented your workaround. From my tests it works. I will submit a patch later.
Maybe we should put this in as an admin selected feature. So the site admin can decide if he wants his realm modified.

Something like

Disabled
Enabled with web browser HTTP-AUTH security
Enabled with web browser HTTP-AUTH security, with browser logout workaround
Enabled with HTML login form

And some sort of description of what the workaround does.

    $realm = variable_get('securesite_realm', variable_get('site_name', 'drupal'));
    
    // fix logout on cancel in Opera and IE
    $browser_user_agent = strtolower( $_SERVER['HTTP_USER_AGENT'] );
    if (strpos($browser_user_agent, "gecko") === FALSE) { //Firefox
      $suffix = ' ,'. mt_rand(10, 99);
    }
    else { //Opera, IE, others?
      $suffix = '';
    }
    
    header('WWW-Authenticate: Basic realm="' . $realm . $suffix . '"');
    header('HTTP/1.0 401 Unauthorized');

Subscribing.

Let's leave out the browser checking and just do it for all browsers. It shouldn't hurt Mozilla. And how about a "-" between the realm and the suffix?

I test it the idea with firefox, but it does not work. Firefox only clears the AUTH variables when the dialog is presented to the user with the same realm that they were created with. I think Firefox is doing things correctly (shocker). I wish all browser would just work the same.

@NaX: I'll file a bug report with Opera.

Committed to DRUPAL-4-7 and HEAD. Please give it a test.

Nice to see this implemented, it didn't show up in "my issues" (it was closed before the post about the new thread was sent) so I missed this. But to be fair, shouldn't I get credit for this patch? ;)

@Darren Oh
I was wondering if this is correct. ('htps:/')

  '#default_value' => variable_get('securesite_realm', ltrim($base_url, 'htps:/')),

I was thinking something more like this

  list($protocol, $ver) = explode("/", strtolower($_SERVER['SERVER_PROTOCOL']));
  ...
  '#default_value' => variable_get('securesite_realm', ltrim($base_url, $protocol . '://')),

If not feel free to close the issue.

Please disregard my suggestion. It wont work as you requires more than 1 line to call variable_get.