4

I have a requirement in which the user should not be able to see the books in the site unless he is logged in. And the user is not able to see the content.

The problem is when a user logs in, views a book and its child pages, and logs out; he is still able to view the pages he opened before when he was logged in, by pressing the back button of the browser. He is not able to make any changes though.

This may create problems when users visit the site from a public computer, log off, and go away without closing the browser window.

Is there a module or any setting change I can use to solve this issue?

Improve this question
2
  • There is a module in D7 named "bbr" Browser Back Button.
    – Yogesh Kushwaha
    Nov 20, 2017 at 14:14
  • @YogeshKushwaha I see that you wrote the module recently! Good job for the same! Can you add the link and module excerpt as an answer to the question?
    – AjitS
    Nov 20, 2017 at 15:07

4 Answers 4

Reset to default
7

This is a result of the browser caching the page, there's not a lot you can do about it really.

Some browsers might respond to setting cache control headers like the following:

header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past

which might force the browser to re-load the page regardless of it's local cache.

There are apparently some options available to control this in Safari specifically, but I haven't been able to find anything for other browsers. I imagine the same would work for Chrome (being Webkit based), but I can't comment on the the other major browsers.

Improve this answer
9
  • 2
    Upvoted for a good answer, but I doubt webkit has anything to with it. Webkit handles only layout, and I imagine doesn't care at all about HTTP headers.
    – Letharion
    Apr 3, 2012 at 12:59
  • @Letharion Do you mean that Webkit doesn't control any of the browser's navigation then and just handles layout? I was under the impression Webkit was the basis for the entire browser (not just the rendering engine), have I got that wrong? Oh by the way, the other post I linked to was a JS solution to the problem which is why I mentioned Webkit at all
    – Clive ♦
    Apr 3, 2012 at 13:04
  • 2
    I haven't examined the code, but I believe webkit is only a small part of most browsers using it. Wikipedia start with: "WebKit is a layout engine". Webkit's own website says under goals that it should be "a general-purpose display and interaction engine".
    – Letharion
    Apr 3, 2012 at 13:08
  • 1
    @Ajit that's the point I was making...it's a client side browser issue, so there's nothing you can do. If that's how the browser wants to react then that's how it will react, you won't be able to control it
    – Clive ♦
    Apr 4, 2012 at 12:00
  • 4
    If you have seen the page before, you can see the page again. That's just how computers work! I've used some internet banking sites that claim to disable the back button in the browser, but this is just ridiculous and is very easy to circumvent. If someone at a public computer leaves their browser open without logging off, that's a user error!
    – Chris Cohen
    Jun 21, 2012 at 9:19
1

You can't stop the user from looking at the cache of his own browser. And you should not even try. Breaking the browser's navigation paradigm is not a recommended practice.

Having said that, there are tricks you can use to make it appear as if the back button is disabled. Users can get around those tricks, but you may fool some of the people some of the time.

Here is one page that explains those tricks: http://viralpatel.net/blogs/disable-back-button-browser-javascript/

Searching with Google for "Disable back button" will give you a lot more.

To add js to your site, look up drupal_add_js in the API.

Improve this answer
1

Its too late but I came with a perfect solution. I have written a module Back Button Refresh.

Configuration

Install the module as regular process then configure Back Button Refresh block visibility settings in Home » Administration » Structure » Blocks

  • Search Back Button Refresh block and set it to bottom region of your default theme. If admin theme is different then do the block settings for all of your theme you are using and has user restricted data so that this block must be available on your sensitive pages.
  • Set visibility of block to display on all pages.

Any suggestions are most welcome.

Improve this answer
0

You could use this code in a custom module :

<?php 
/**
 * Implements hook_init().
 */
function MY_MODULE_init() {
  drupal_add_http_header('Cache-Control', 'no-cache, no-store, max-age=0, must-revalidate, post-check=0, pre-check=0');
}
?>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.