javascript - 如何从浏览器中删除 'Authorization: Basic username:password' header

Question

我一直在尝试使用浏览器中提供的 native 登录提示:

并一直关注Steven Sanderson's blog post .

如博客中所述，一旦用户输入了他们的登录详细信息，浏览器就会在所有 future 的请求中向登录 URL 发送 header Authorization: Basic username:password。这意味着如果用户注销，但没有关闭浏览器窗口，下次访问登录页面时，他们会在访问登录页面时自动登录。实际上，浏览器会存储身份验证详细信息，直到浏览器关闭 - 让您的帐户对未经授权的访问开放。

有没有办法让浏览器忘记授权信息，这样用户就无法在不重新输入详细信息的情况下再次登录？

Answer 1

如 wikipedia 中所写:

Existing browsers retain authentication information until the tab or browser is closed or the user clears the history. [1] HTTP does not provide a method for a server to direct clients to discard these cached credentials. This means that there is no effective way for a server to "log out" the user without closing the browser. This is a significant defect that requires browser manufacturers to support a 'logout' user interface element (mentioned in RFC 1945, but not implemented by most browsers) or API available to JavaScript, further extensions to HTTP, or use of existing alternative techniques such as retrieving the page over SSL/TLS with an unguessable string in the URL.

一般看来是不行的