If you want the server side app to cause the logout, then AFAIK, you will not be able to do so when the mechanism is BASIC auth, because there is no way for the server to tell the browser to stop sending the authenticator.
The Servlet EG is discussing the addition of portable logout methods to the servlet 3.0 API, but in the case of BASIC AUTH, these methods will be subject to the problem described above.
Ron
[Message sent by forum member 'monzillo' (monzillo)]
http://forums.java.net/jive/thread.jspa?messageID=301617