# Authentication in WebDev Module **URL:** \ **Category:** Ignition\ **Created:** [July 31, 2017, 4:23pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937 "2017-07-31T16:23:41Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [July 31, 2017, 4:23pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/1 "2017-07-31T16:23:41Z")
**UPDATE: This is resolved in Ignition versions 7.9.5 and higher. Make sure you also have the latest version of the WebDev module itself.** I am working on a simple JSON api to return some tag data. I have easily been able to implement the ‘Require Authentication’ checkbox. I am facing two issues. They both revolve around the fact that the user appears to get one shot entering their credentials. If the user enters the credentials correctly, I can’t seem to find a way for them to log out and destroy the session dictionary related to the user. I have tried setting session[‘user’] to none, and also removing the ‘user’ key from the session dictionary. I also tried using system.security.logout(). Neither of these worked. Additionally, if the credentials are entered incorrectly, the user does not get another chance to enter the credentials. They are forced to quit their browser and reopen it to try again. Is there a way to destroy this session[‘user’] object and prompt the user to enter their login info again without forcing them to quit and reopen their browser? ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [August 1, 2017, 2:32pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/2 "2017-08-01T14:32:52Z")
Update 8/1/17 : I have also tried resetting the session equal to an empty dict `session = {}`. This doesn’t seem to work. I came across a couple articles suggesting to send wrong credentials as a workaround, but this doesn’t seem to work either. Any help would be much appreciated. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 1, 2017, 9:01pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/3 "2017-08-01T21:01:32Z")
I think this is a bug in the WebDev module. It seems we’re returning a 403 when we should be returning 401. Clearing the session on the server has no effect on the browser, which after seeing a 403 does not need to ask for credentials again. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [August 1, 2017, 9:13pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/4 "2017-08-01T21:13:42Z")
Basically, I just need some way for the session to be cleared and the HTTP basic login box to pop back up without closing the browser. Can you think of anything else I can do to get around this? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 1, 2017, 10:05pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/5 "2017-08-01T22:05:44Z")
Even changing it to a 401, with or without invalidating the session, doesn’t seem to work… I have no idea how to convince the browser to forget the credentials. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [August 2, 2017, 2:26pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/6 "2017-08-02T14:26:35Z")
I think this is a pretty standard feature for the WebDev module to have. Can we work toward a resolution? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 2, 2017, 2:38pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/7 "2017-08-02T14:38:06Z")
We figured out that it needs to be a 401 response that includes a `WWW-Authenticate` header. It will be fixed in an upcoming release. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [August 2, 2017, 3:05pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/8 "2017-08-02T15:05:49Z")
Thank you Kevin! If you could update the thread when you know what version this will be included in, that would be great. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [August 2, 2017, 3:47pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/9 "2017-08-02T15:47:05Z")
Can you provide a rough timeline for when this will be fixed/released? We need to make a decision in the next few days if we will roll our own authentication or use the build in web-dev auth. Please let me know as soon as possible. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [August 2, 2017, 4:03pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/10 "2017-08-02T16:03:19Z")
It’s scheduled for 7.9.5. I don’t know how long that will be - 7.9.4 is only in release candidate phase right now. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [August 2, 2017, 5:35pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/11 "2017-08-02T17:35:18Z")
Thank you again Kevin! ---
**Author:** ![iscrac](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/iscrac/32/49757_2.png) [@iscrac](https://forum.inductiveautomation.com/u/iscrac)\ **Post date:** [October 2, 2017, 12:41pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/12 "2017-10-02T12:41:45Z")
Hello! Is there something new about authentication? Thanx in Advance! ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [October 2, 2017, 3:05pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/13 "2017-10-02T15:05:37Z")
This fix/change will be in 7.9.5. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [November 8, 2017, 9:53pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/14 "2017-11-08T21:53:12Z")
Now that 7.9.4 is released, is there a timeframe for version 7.9.5. This is a very critical feature for us. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [November 8, 2017, 10:01pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/15 "2017-11-08T22:01:30Z")
7.9.5 should be released sometime next week unless testing turns up some issues. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [November 8, 2017, 10:27pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/16 "2017-11-08T22:27:54Z")
Awesome! Thanks for the quick response Kevin. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [November 20, 2017, 4:41pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/17 "2017-11-20T16:41:33Z")
7.9.5 was released, and we have updated. However, i am still getting this issue. I have a script in webdev with just a hello world and have checked require authentication. I am still getting a 403 response when I enter bad credentials and am not prompted again to re-enter them. I am stuck quitting my browser, then reopening to get the HTTP Basic login form to show up again. What I really need, is to be prompted again if the login information is invalid. Additionally, if I am authenticated I would hope that sending a garbage username and password to the url will function as a log out of sorts and would expect this to send a 401 response for bad authentication. Please let me know if there is something I am missing. ---
**Author:** ![ryanjmclaughlin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryanjmclaughlin/32/4318_2.png) [@ryanjmclaughlin](https://forum.inductiveautomation.com/u/ryanjmclaughlin)\ **Post date:** [November 20, 2017, 4:54pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/18 "2017-11-20T16:54:28Z")
Just to double check… you updated the WebDev module too? THe Ignition installer does not contain the WebDev module upgrade. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [November 20, 2017, 5:03pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/19 "2017-11-20T17:03:40Z")
I did not, let me give that a try! ---
**Author:** ![ctonge](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@ctonge](https://forum.inductiveautomation.com/u/ctonge)\ **Post date:** [January 25, 2018, 3:00pm UTC](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937/20 "2018-01-25T15:00:10Z")
Were you able to confirm this is resolved? I am still on 7.9.4 and definitely have the same issue, so I’ll be happy if an update fixes this. [Next page](https://forum.inductiveautomation.com/t/authentication-in-webdev-module/14937.md?page=2)