Feature Requests

Hi

Why isn´t there any logout button in the WebUI?
I think it would be good if there is a logout button to kill the session.
Otherwise I have to close all the opened taps including the browser window.

Is there no way to include such thing? Is this not a security issue?

kr
bb

I don't understand why you've opened another thread about this topic.

Anyway, I'm quoting my reply for your first question:

m0n0wall is using HTTP authentication and therefore a "logout" is not possible.

There is no session:

Existing browsers retain authentication information until the tab or browser is closed or the user clears the history. HTTP does not provide a method for a server to direct clients to discard these cached credentials. This means that there is no effective way for a server to "log out" the user without changing the realm periodically, directing the user to close the browser, or using sessions in the URL.

And I don't think you have to worry about it. Recently, Manuel removed all modifying GETs and introduced CSRF magic tokens to the webgui.

yep, sorry for the double entry   

Thank you for your detailed explanation.

best regards
bb