If you implement your own authentication scheme you can do whatever you want, usually by binding a login (from a standard HTML form) to a session. See for example CGI::Session.

Update/note: some browsers allow you to use URLs like http://username:password@www.example.com to automatically log the user in. You may be able to do something with that.

Update2: if you use digest authentication you may be able to invalidate a current login (thus logging a user out again). You can't do that at all using Basic Authentication, since the credential sent to the server is just a base64 encoded user:password string and never changes unless the username and/or password changes, and the browser will remember those until you restart it.

Joost, how would you go about to avoid another standard login-pop-up when you invalidate the digest login?

There is no way to do this provided in the http specification. But being ever so stubborn, I've agonized more than once on how to get around this, and even tried some rather bizarre ideas that did not work out. Looking at the site you referenced in your update, I think this bullet point is the key:

• Effectively eliminates the login popup box; works with recent Internet Explorer updates.

This implies that something is different about newer versions of MSIE that provides a way to bypass the standard browser login method. They do not specifically mention any other browsers that this will work with. Anyway, I'm still curious, so if you figure out what they're doing please post an update.

Clint

You should take a look at mod_perl, a very powerful plugin for the Apache web server. The little popup dialog you get when accessing protected areas of a website is the default "Basic Authentication" handler. But with mod_perl you can write your own handler, and request that it be used for authentication of certain areas rather than the default.

Here are some links to get you started:

http://perl.apache.org/

http://www.modperl.com/

http://www.modperlbook.org/html/index.html

If you use the .htaccess to authenticate users by enabling the require valid-user directive as well as providing login form, then the users need to authenticate twice.

1. Apache features
Basic and/or digest authentication - afaik, there is no way how to change browser behavior when auth credentials requested by Apache. Additionally, there is no way how to command browser to forgot used credentials (log out).

2. Proprietary features
it is possible and relatively easy to do, but it depends on your application framework (I mean modperl || php || cgi || ...). I can imagine mod_perl PerlHandler, which is the first in the handler chain, and which checks some cookie containing session ID.
If unsatisfied, prints the html login page and AVOIDS next handler in the chain to process.
If unsatisfied but login and password sent, checks it against rdbms or file, creates unique session id and sets related cookie.
If satisfied, does nothing special, just leaves processing to the next handler of the chain.
Update: I have such handler somewhere, so, let me know if you (or somebody else) are interested in...

I often use modules based on Apache::AuthCookie to get this effect. Instead of your browser remembering HTTP Auth information, it remembers a cookie. Cookies are much more flexible than HTTP Auth: they can be deleted for logout and obtained through a variety of means, including an HTML form.

Good luck!