Credentials are never removed from WebCore credential storage, which has at least two downsides: - if the remembered credentials are wrong, they will be sent with future requests, doubling server-side incorrect login counts; - implementing logout by returning 401 in a response to valid credentials doesn't work. Note that this is not the best way to log out though, since an auth dialog will appear, which the user will have to cancel. <rdar://problem/7062824>
Created attachment 62134 [details] proposed fix
Comment on attachment 62134 [details] proposed fix Is there a race in the “storing a new credential” case was well as in the removal case? I ask because your comment in removal seemed to offer no reason this was specific to removal.
The credentials are stored when they become known (and re-stored as default for directory when used). If a race condition happens there, it's really a bug in Web site code, we can do nothing to fix it. In contrast, we could store ResourceHandle "current credential" to make sure that we're not removing a different one.
http://trac.webkit.org/changeset/63834 might have broken GTK Linux 32-bit Release
Yes, committed in <http://trac.webkit.org/changeset/63834> with follow up fixes in <http://trac.webkit.org/changeset/63836>.