tags:

views:

260

answers:

2

Im using wamp server for my php scripts. And Im having difficulties on the logout code. Every time I click on the logout link and then click on the back button on web browser it still shows the page which can only be access by the user who is logged in. I have this code at the beginning of the index.php which is called by the log out link to destroy the session:

<?php
session_start();
session_destroy();


?>

And I have this at the beginning of the user page:

<? 
session_start();
if(!session_is_registered(myusername)){
header("location:login.php");
}
?>

I don't know why the userpage can still be access after the user has logged out. So I'm thinking of disabling the back button when the user has logged out. Please help.

+9  A: 

You should instead set the page to not be cacheable, like this:

header("Cache-Control: no-cache, must-revalidate");
header("Expires: Thu, 15 Apr 2010 20:00:00 GMT");

This way the client should re-request the page when hitting back, getting the a fresh "logged out" version from the server.

On another note, don't ever mess with the client's buttons, they expect them to work a certain way, best for your site to behave like 99.999% of the internet and not break their experience.

Nick Craver
What he's asking for is impossible (by design) in any case. Even if you set a page leave handler and do nothing, most modern browsers will detect this anti pattern and allow the user to leave the page anyway. +1.
Billy ONeal
I don't get it, please I'm still a beginner. Where do I put the code. I tried putting it like this in the <head> portion of the page:<?phpheader("Cache-Control: no-cache, must-revalidate");?>but did not work
@user225269 - Updated...I forgot the expires header to go along with it (sorry, been a while since a PHP project). You stick this on the page you don't want them to go back to (or not see the cached version rather), it tells the client that this page is no good on reload and it needs to ask the server for it again.
Nick Craver
Headers must be sent before any content is output to the browser. Don't put it in the <head> portion, put it above ALL output.
thetaiko
A: 

To stop your browser from caching the pages add these two lines of codes in your head tag of html or php file(if using with html)

Prabhat Singh