Subject: Re: Past Proposals for HTTP Auth Logout

From: Bil Corry <[email-masked]>
Date: Fri, 05 Mar 2010 22:54:46 -0800

Tim wrote on 2/25/2010 8:06 AM: 
> Bil,
> 
> I've taken your trick for log outs and combined it with a few other
> tricks to build a sample application which achieves login, logout, and
> password changes all without the traditional HTTP authentication
> prompt.  Take a peek:

Thanks for putting this together and testing it across the major browsers.  It's a great resource for anyone wanting to implement HTTP Auth logouts.

> It seems to work well in IE 6, 7, and 8, as well as Firefox, Chrome,
> and Safari.  It still doesn't work in Opera

The Opera team is pretty responsive -- if you let them know how they're not compatible, yet all the other browsers are, I suspect they'll change the behavior to match.

- Bil

---

From: Yutaka OIWA <[email-masked]>
Date: Fri, 19 Mar 2010 21:12:22 +0900

Dear Tim and other people who're involved/interested in this issue,

If you will be in IETF 77 in Anaheim, it seems to me a good opportunity for
us to make an off-line discussion there, to share a common view on some
future direction (and possibly finding a nice place to discuss it further :-).

We will be in Anaheim for attending OAuth, HTTPBIS and other WGs until Thursday,
and if you're interested, please find us there.

# You're also welcome to contact me by personal email if you want.

# please also take a look on another email I posted to OAuth ML and
# public-web-security ML just now.

Cheers,

-- 
Yutaka OIWA, Ph.D.                                       Research Scientist
                            Research Center for Information Security (RCIS)
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]