1

I have a profile information page that is being displayed for an authenticated users. But after I log-out as that specific user,and then i click the back button of the browser,I could find the anonymous user landing on the profile information of the previously logged-in user.

How could I prevent such a behavior as I do have some confidential information on those profile information page.

Could someone please help me.

Improve this question
3

Once page is stored in browser's cache, there is nothing you can do about it. It's responsibility of an user who logs in and views confidential information to remove it from device he was reading it on.

You could try to prevent caching (as described in this question), but all you send to browsers and proxies in that regard is just an suggestion, not an order. It's a good idea to do this, but sadly you can't be sure of it.

You could use javascript to go to another page if logged out user tries to go back to page with sensitive data.

And you can and should use Secure Pages to enforce encryption and thus prevent proxies from reading you data.

At the end of the day once user will get that data, data security is his problem.

Improve this answer
  • Almost all browsers respect cache limits, and that's how gmail, Paypal, etc prevents such problems. So cache exclusion would be your first step. – AyeshK Jun 17 '13 at 13:57
  • @AyeshK - almost is the key word here. And most of them keeps data in RAM unencrypted anyway, so it can be retrieved - if it hits swap, sometimes even hours after. Of course making it harder to steal data is always good idea, but it's also good to know one's limits. – Mołot Jun 17 '13 at 14:01
  • taxnx for the info.i have installed this cache exclusion module..and i have specified the page to exclude the cache.But still the data is being shown. – arteta Jun 17 '13 at 14:09
  • Have you tried drupal.org/node/197786#comment-1817644 as seen in question I linked? – Mołot Jun 17 '13 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.