IE, FireFox, Opera, and Safari don't display B

Question

SCENARIO:

I have a java web app running in the latest Tomcat 6. I also have a single servlet filter that provides authentication. I support BASIC auth and it appears to work fine - most of the time.

The first time a browser [pick any one - IE, FireFox, Opera, Safari, Chrome] hits one of our protected URL(s), it displays the standard browser-specific login prompt. IFF you enter the proper username/password - everything is fine, a new session is created, and everything operates normally.

IF, however, you entered invalid credentials in the initial BASIC auth dialog, my authentication filter logic handles this by returning another 401 response.

PROBLEM: Unfortunately, at this point, Chrome is the only browser that will display another BASIC auth dialog. All other browsers listed automatically send the cached "Authorization: Basic.." header - instead of clearing it and prompting the user again.

If anyone has seen this or may know why this is happening, I would greatly appreciate any suggestions!

Thanks and Best Regards, Bob

Answer 1

problem solved:

After looking over my code again, I found a point where a 401 was being returned without also setting the WWW-Authenticate HEADER.

-bob