Warning

This document hasn't been checked for compatibility with current versions of Plone. Use at your own risk.

I can't seem to log out of my Plone site - what's wrong?

When i try to log out from my Plone site, it displays a message saying that I've logged out, but doesn't actually log me out. I have no way of logging in as another user.

« Back to Table of Contents

The reason for this is that you have logged in to the ZMI using something called HTTP authentication - the dialog box that pops up asking you for username and password.

This is different from the standard Plone login that uses a cookie to keep track of your login status. Because of the way web browsers are constructed, you can't log out from HTTP authentication - you need to close your browser to do that.

We recommend keeping two separate browser instances (one Firefox and one Internet Explorer, for example) open if you want to have one HTTP login and one cookie-based login. Another option is to use different ways to access the site — http://localhost and http://127.0.0.1 are equivalent ways of accessing Plone on your local computer, but will seem like two different sites to your browser — hence allowing you to log in with HTTP authentication on one, and cookie-based authentication on the other.

Additional tips

  1. If you install Firefox Web Developer Extensions, you can clear the HTTP login data without closing the browser.
  2. You can use acquisition to get to the Control Panel even if you are inside your Plone site. It will then use cookie-based login to authenticate you, meaning you can log out again. This also makes it unnecessary to have a special open port on port 8080 to let you get to the ZMI for normal tasks like restarting the server.

Example:

If your Plone site is http://localhost:8080/plonesite and mapped to the domain myplonesite.com, you can do:

http://myplonesite.com/Control_Panel/manage_main

which will give you the Control Panel, so you can pack the DB, restart, refresh products, etc. This assumes you have a user at the root level, but will still use cookie auth to log you in - so you can have a user at the root called "admin" to perform these tasks, and still log out afterwards.