Using a simple virtual host, I want to set a timeout of X minutes (same of set an expired authentication) to force the user to re-insert its credentials.

<Directory /home/user1/>
        Order allow,deny
        Allow from All
        Options -FollowSymLinks +Indexes +Includes -MultiViews
        IndexOptions +IgnoreCase +SuppressDescription +FoldersFirst +NameWidth=40 +SuppressHTMLPreamble +FancyIndexing +IconHeight=16 +IconWidth=16
        AllowOverride none
        AuthUserFile /etc/apache2/user1.pass
        AuthName "server.example.com"
        AuthType Digest
        require valid-user


As I know apache/HTTP authentication don't gives you control.
After first authentication, your server cannot instruct the browser to logout or timeout, because HTTP authentication doesn't work with session/cookies and the browser will continuously send authentication credentials. To logout you should close the browser.

but looking in Apache webpage: AuthDigestNonceLifetime Directive might be useful

from apache web page:

The AuthDigestNonceLifetime directive controls how long the server nonce is valid. When the client contacts the server using an expired nonce the server will send back a 401 with stale=true. If seconds is greater than 0 then it specifies the amount of time for which the nonce is valid; this should probably never be set to less than 10 seconds. If seconds is less than 0 then the nonce never expire

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.