经典asp站点的注销功能
有没有办法为使用经典 asp 并使用 Windows 身份验证的站点提供注销功能（即受限制的文件夹通过服务器操作系统设置其权限，并且用户名/密码存储在 Active Directory 中）？
如果有任何区别，则服务器正在运行 IIS 5.0。注销至少需要适用于 IE（6、7 和 8）和 Firefox。
请注意，这是一个古老且相当大的站点 - 有数百个单独的 ASP 页面 - 因此任何涉及更改单独页面的解决方案根本行不通。 （出于同样的原因，以及基本的礼貌，请不要建议更改为 asp.net。）
到目前为止，我发现发送 401 响应代码可能会导致某些浏览器清除身份验证，但是（1）我不知道该怎么做，（2）我真的更喜欢真正有效的东西，而不是仅仅有机会工作。我还知道摆弄 Session 对象（例如，.Abandon）是完全没有意义的，因为这不是完成身份验证的地方。
Is there any way to provide a logout function for a site which uses classic asp, and which uses Windows authentication (i.e. the restricted folders have their permissions set via the server OS, and usernames/passwords are stored in Active Directory)?
If it makes any difference, the server is running IIS 5.0. The logout needs to work for IE (6, 7, and 8) and Firefox at the very least.
Note that this is an old and fairly large site - many hundreds of individual asp pages - so any solution that would involve changing individual pages simply will not work. (For the same reason, as well as basic politeness, please don't suggest changing to asp.net.)
What I've found so far suggests that sending a 401 response code might cause some browsers to clear the authentication, but (1) I don't know how to do that, and (2) I'd really prefer something that actually works, rather than just has an off chance of working. I also know that fiddling with the Session object (.Abandon, for example) would be completely pointless because that's not where the authentication is done.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您对“注销”一词的使用令人困惑。通常，站点负责管理登录/退出，这通常是使用会话对象完成的，但这不是您所讨论的。
我认为您可能正在谈论两种可能的事情。
连接身份验证
首先，Windows 集成安全性完成的类型身份验证是在连接级别执行的。一旦连接经过身份验证，该连接（在 HTTP/1.1 下默认保持打开状态）就可以使用，而无需进一步进行身份验证握手。
通过在响应中包含
Connection: close标头，可以说服客户端或服务器关闭连接，但这实际上可能不会导致连接关闭。此外，客户端可能同时打开 2 个或更多经过身份验证的连接。在这种情况下，上述方法只会关闭其中一个。
这里的结论是，对于每个会话级别的经过身份验证的连接，您几乎无能为力。
凭据缓存
IE 将在 IE 会话期间缓存用户为网络登录特定站点而输入的凭据。因此，即使您确实设法关闭了现有的经过身份验证的连接，IE 也会简单地重新使用缓存的凭据来默默地完成任何后续的身份验证握手。可能可以将客户端配置为不执行此操作，但我怀疑您可以使用它。
结论
（至少我认为您在问的问题）的答案是：不，您不能。
Your use of the term "logout" is confusing. Usually its the sites reposibility to manage logins/outs and this is typically done using the session object but this not what you are talking about.
I perceive two possible things you may be talking about.
Connection Authentication
Firstly the fact that authentication of the type done by Windows integrated security is performed at the connection level. Once a connection has been authenticated that connection (which under HTTP/1.1 is by default maintained in an open state) can be used with no further need for the authentications handshakes.
It may be possible to convince the client or server to close the connection by including the
Connection: closeheader in the response but this may not actually result in the connection being closed.Additionally a client may have 2 or more authenticated connections open at a time. This case the above approach would only close one of them.
The conclusion here is that there is little you can do about authenticated connections at a per session level.
Credential caching
IE will cache the credentials a user enters for a Network logon to a specific site for the duration of the IE session. So even if you do managed to close the existing authenticated connections IE will simply re-use the cached credentials to complete any subsequent authentication handshake silently. It may be possible to configure the client not to do this but I doubt that is something you can use.
Conclusion
The answer to (at least the question I perceive you are asking) is: no you can't.