GeoServer WFS-Transaction authentication in web browsers

Question

I am developing a webGIS application with editable layers which uses transactional WFS through GeoServer to do CRUD operations in a PostGIS table. I was able to set up the authentication for wfs-t transactions in GeoServer and it works well: when i want to save the edits/new features a popup window appears with authentication request:

if I type the correct username&password the transaction makes the geometry changes.

The security issue is: this authentication will be kept until the whole browser window is open, it's not enough to close the browser tab. It won't ask again for the authentication until you close the whole browser and reopen it.

So if you don't close the browser anybody can edit your layer.

Do you have any idea how to "sign out" to forget the authentication keys, without closing the whole browser window?

Answer 1

I found the solution. GeoServer uses basic HTTP authentication security, which is stored in a key until the user doesn't close the whole browser window. You can't sign out from it, just overwrite the authentication with fake username/password. This causes "logging off".

Just call this function (ajax needed):

      function logout() {
   $.ajax({
url: 'http://fakeusername:[email protected]:8080/geoserver/rece_wfs/ows',
type: 'post',
dataType: 'jsonp',
success: function(result){
//alert(result);
},
error: function(result){
//alert(you are logged out);
}
});  
}