Topic: Server-manager, no "logoff"?!

[F.Briffod]

This is another security issue:
There is not "logoff" or "sign out" or something that automatically remove files from cache. So, if you close the window of your web "server-manager", open a new one and try to contact the server-manager again with http, no password are required!?!!
This could be dangerous because "everybody" could use your computer to access Server-manager!

Thanks.

F.Briffod

[Luke Drumm]

I can't speak for anybody else but my setup seems to work as expected.

If I log into server-manager, close down my browser (IE 6) and then attempt to get into server manager again, it prompts me for the password again.
This seems inline with any other session based password protection scheme.

PS: Please note that in the case of some browsers, all windows need to be closed before the browser will dispose of the login details.

Regards,
Luke

[Charlie Brady]

Luke Drumm wrote:

> If I log into server-manager, close down my browser (IE 6)
> and then attempt to get into server manager again, it prompts
> me for the password again.
> This seems inline with any other session based password
> protection scheme.

Perfectly correct. This is a limitation of the HTTP authentication system and there is nothing that we can do about it.
 
> PS: Please note that in the case of some browsers, all
> windows need to be closed before the browser will dispose of
> the login details.

To be safe, let's say "all browsers".

Regards

Charlie

[Sergio]

Sorry, but this is not a good solution. Using the basic authentication mechanism of the web server is asking for real trouble as it exposes the passwords in plain view (Yes there is https... but is it snot good enougth)

You should build a logon that issues a session cookie and checks for the cookie's validity. You should be able to do this as a cmponent that is attached to the administration cgi script and launch each functionality as a loadable package.

Then, logging off is as simple as erasing the cookie. The adminsitrator then doesn't need to turn off the browser.

Another advantage is that you can have one box performing authentication and use cookie withing a howle domain so an admin doesn't need to login into each box!

Sergio

[technostruct]

Has anybody done anything for an add-on or found a link to a website regarding this capability:idea:??

This is something I would enjoy having myself.  I like the server authentication, the 128-bit SSL link, and I'd even more enjoy a "logoff" session cookie.

Anybody ?