3

How can i prevent users who have logged out from accessing their account when they try to access their account by clicking the browser previous-page button?

Currently, users can access their previous session by simply clicking the previous page button. how can i prevent this, thus, they get redirected to the log in form/page?

4
  • Are users actually able to access their session or are they just able to view a version of their profile page that has been cached by their web browser?
    – sheena_d
    Dec 28 '11 at 22:15
  • Hi, I've just checked and it seems they are just cached pages. is there a way of preventing this? Dec 28 '11 at 22:46
  • 2
    I found an open drupal core issue for D6 that seems to be related. Comment #193 explains that it may be a hosting issue (which would mean that it applies to any version of Drupal) and there are various suggestions for fixes.
    – sheena_d
    Dec 28 '11 at 23:08
  • btw, I'm currently hosting my site on my localhost. So am not sure whether its a hosting issue in my case. thanks for the link though, was quite informative. Dec 29 '11 at 0:54
1

Others have already mentioned that this is a caching issue, not a Drupal issue. Two thoughts:

  1. Blocking the 'back' viewing of previous pages would conceptually be possible if the cached page (The one you clicked 'logout' on) contains Javascript that checks if the back button was pressed to arrive at that page. If 'Yes', then force a refresh or check for active credentials before allowing the display.
  2. If you set appropriate Cache-Control headers and always generate an EXPIRED time in the past (example here) on all pages that display the 'logout' link, you can control this behavior in browsers that choose to comply.

Method #1 seems complex and could be impossible. #2 might be a 'best fit' but certainly not bulletproof. I would weigh the effort that is required to continue down this road against the overall concern you have of client machines storing cached pages.

2

There's nothing that can be done to correct this, it's a browser caching issue. When you hit the back button, it loads the original HTML from the cache, not the modified HTML.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.