117

How can I make Firefox "invalidate" it's saved HTTP Basic Auth credentials for a website from the client side?

Currently, I have to restart the browser, which is rather cumbersome with multiple tabs open.

Is there a way to do this without having to restart Firefox/clear the cache/etc.

Improve this question

8 Answers 8

Reset to default
101

You can choose Clear Recent History from the History menu (Ctrl + Shift + Del, Macs: Cmd ⌘ + Shift + Del). You can then select to just clear Active Logins from the details to just clear those sessions.

In older versions of Firefox (such as FF3), Clear Recent History is under the Tools menu. The shortcut is the same.

Improve this answer
2
  • 7
    In the current Firefox, this menu option is in the History menu, not Tools. I verified this with Firefox 29.0.1.
    – Mei
    May 20, 2014 at 16:13
  • works on firefox thanx
    – themhz
    Oct 6, 2016 at 15:36
89

If you change username and password from the original session to one which will not authenticate, Firefox will destroy all reference to the old authentication and attempt the new one.

You can change/set authentication by adding user:pass@ to the beginning of the URL, example: http://user:pass@www.example.com/

If you are logged into www.example.com with user:pass then typing (adding to the beginning of the address) anything@ will cause this to happen, example: http://abc@www.example.com/

A fast fix which doesn't require any plugins.

Please note this only works for HTTP Basic Auth.

An additional side benefit is this will affect only the website you are interacting with. All other logins to any other website will remain active.

Improve this answer
5
  • 7
    This is an awesome answer. Simple, easy-to-use, no additional software required, and clever in a non-obviously obvious sort of way.
    – wfaulk
    Mar 19, 2013 at 16:30
  • 4
    On a side note, this should work with most other browsers also, including Chrome and Internet Explorer (IE)
    – Drew Anderson
    Sep 19, 2013 at 8:51
  • @DrewAnderson last time I checked, only firefox supported the user:pass@ notation in the url bar.
    – masterxilo
    Jun 17, 2019 at 11:36
  • My current Apache2 configuration just cuts away basic-auth part in URL, so I had to fallback to "official" way by heavyd above.
    – Niki Romagnoli
    Oct 24, 2022 at 13:48
  • I use the slightly shorter version user@www.example.com , an empty password works just as well.
    – quazgar
    May 22 at 10:04
12

The Web Developer toolbar allows HTTP authentication to be reset within a browser session.

From Firefox's Context Menu, choose Web Developer -> Miscellaneous -> Clear Private Data -> HTTP Authentication.

Improve this answer
3
  • 2
    Can't find this on current Firefox
    – Scolytus
    Feb 12, 2015 at 7:44
  • 3
    Unfortunately, that feature seems to have disappeared at some point since I posted this answer.
    – boot13
    Feb 12, 2015 at 13:25
  • 1
    Just tested it, works! Please note: that's not part of Firefox's bundled dev tools, you have to install the linked add-on.
    – Diego V
    Oct 25, 2017 at 8:08
6

Make the request from a private window.

In Firefox: File - New Private Window (Ubuntu Ctrl+Shift+P)
In Chrome New incognito Window (Ubuntu Ctrl+Shift+N)

Improve this answer
3

there is no way for the website to offer a log out option

This is wrong. There are several and simple ways for the website to offer a logout options.

1) Logout link will point to a URL on the same domain containing credentials that are intentionally incorrect

2) Logout link will trigger javascript with following code snippet (Microsoft Internet Explorer only):

<script>document.execCommand('ClearAuthenticationCache', 'false');</script>
Improve this answer
2
  • 3
    there doesn't seem to be a way to reliably invalidates credentials that behaves consistently across browses and doesn't pop up an unwanted login box.
    – Michael
    Dec 16, 2014 at 16:42
  • Logout link using incorrect credentials is already covered in another answer
    – Dmitry Grigoryev
    Oct 2, 2015 at 22:54
0

Not sure if this will help anyone else, but in my case i thought that it was a bad password that firefox was storing when i couldn't access a site with basic HTTP authentication. But it turns out that site was actually using NTLMv1 (windows version of basic http authentication) which firefox has now disabled by default since version 30.

To enable go to about:config, and set the pref network.negotiate-auth.allow-insecure-ntlm-v1 to True.

Firefox does not prompt for password for http authenticated sites, how to make it prompt?

Improve this answer
-2

Well, I expire the client's PHPSESSIONID.  When you expire it, it will remove it from the client browser. The second step (which I haven't figured out) would be to delete the session cookie on the server side that would remove the auth state on the server before it times out and will prevent the server from generating a new phpsessionid when it see this client without the cookie.

    <script type="text/javascript">
        document.cookie = "PHPSESSID=;Path=/;expires=Thu, 01 Jan 1970 00:00:01 GMT;";     
    </script>
Improve this answer
3
  • An HTTP basic authentication does not imply a session in the server, neither a cookie. Also, even if it did, your solution would not work in almost any case since nowadays almost all session cookies are marked as secure which forbids javascript to access them.
    – NuTTyX
    Nov 19, 2017 at 20:04
  • well it takes a cookie out of firefox browser when I look at the cookies, but there is more to it. when I clear the bowser cache and delete active logins, then when I go back to the directory on the website I get the http auth dialog box. I wonder if there is a global command that will flush its active login from the browser. If not, there should be.
    – drtechno
    Nov 25, 2017 at 3:19
  • My bad, I meant "http-only" flag which forbids javascript to access the data inside the cookie programmatically. As for the original question itself, I stumbled upon a way which would make some browsers forget, but in some cases (like in IE) they have rendered it unusable for security reasons: if you type the url prefixed by a nonexistent user and password, they would "overwrite" your previous login: logoff:nopasswd@www.site.com
    – NuTTyX
    Jun 9, 2018 at 15:34
-4

The easiest way is to log out from the site instead of just closing the tab. If this is not an option and you know before hand you will be visiting a site you want forgotten you can install Sandboxie and run your Firefox (or any browser) in a sandbox. Delete the contents of the sandbox when done and everything you have done is gone.

Improve this answer
3
  • 12
    HTTP authentication is a special type of HTTP header that causes your web browser to prompt you for a user name and password, then re-send it automatically when it's needed. When a website uses this type of authentication, there is no way for the website to offer a log out option. In most browsers, you have to close the browser for it to forget your login information.
    – Bavi_H
    Aug 28, 2010 at 2:19
  • @Bavi_H: I've heard that some browsers will forget existing sessions if the site sends a HTTP 401 while logged in.
    – user1686
    Oct 11, 2011 at 17:46
  • 1
    Just clearing site cookies do not invalidate saved username and password for basic authentication.
    – Petr Gladkikh
    Aug 28, 2012 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.