title: Logout from web app using tomcat Basic authentication
body: <p>I am using tomcat basic authentication for my web app:</p>
  
  <p>I added following lines to web.xml in my web app:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;webpages&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;*&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  
      &lt;user-data-constraint&gt;
          &lt;!-- transport-guarantee can be CONFIDENTIAL, INTEGRAL, or NONE --&gt;
          &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
  &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;*&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p>My logout link:</p>
  
  <pre><code>&lt;h:commandLink value="Logout" action="#{userBean.logout}" /&gt;
  </code></pre>
  
  <p>My logout link action:</p>
  
  <pre><code>public void logout() throws IOException
  {
      FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
      FacesContext.getCurrentInstance().getExternalContext().redirect("add_international_job.faces");
  }
  </code></pre>
  
  <p>Now when logout is called, it redirects to another page which should require authentication. But it is rendered as the user is logged in. PS: when the user first time types the url of the same page in address bar, he is presented with authentication challenge(it means that there is no problem in making that page password protected).</p>