Session handling

[Viji nellaiappan]

After user logs out, user should not view any other pages in that website... After user logs out, If user clicks back/forward tab in the toolbar, page should not be displayed.. i.e page should be expired.. How to solve ? How to delete cookies and session ? help me friends..

[TheServant]

It is actually the web browser which stores pages to go backward and forward, so you cannot simply put in some PHP code to make it 100% inaccessable. One way to reduce the number of people going backward and forward is to include some client side code (eg. AJAX) which will check if the user is logged in before it displays the page.
Because PHP is server side the user would have to refresh the page for any PHP to be taken into account.

If this doesn't make sense, look up the difference between server side and client side, and then make a not that browsers are client side and going backward and forward is browser based functions.

[Dormilich]

@TheServant
that is usually the job of your session. once the session is destroyed, backward and forward calls should be handled accordingly (well, that's what sessions are for), unless the browser reads all data from its cache.

[TheServant]

@Dormilich
Yeah, and most browsers will allow that to work like that. However, for example Opera, which I used for this reason, caches all it's pages which made going backward and forward very quick, but it also meant if a session was destroyed, it did not register until the page was refreshed.

[Dormilich]

so unless the actions, that may be triggered by that page, don't do session checks, I see no problem there.

alternatively, you can set Expires headers, which force the browser not to cache these pages.

[Markus]

This is a problem that people often look too far into; sure, the user is able to browse through pages in the browser's history, but as soon as that user attempts to do anything, i.e. click links, then the browser will be fetching new pages, not cached pages. Ergo, your user, assuming you're checking the sessions, will be locked out.

[TheServant]

True. But there are some cases where you would not like them to look back, for example a test/exam which you need to recall a previous answer? Anyway, yeah if you can expire the page that would probably be the best.

[nathj]

Surely if the user has logged out that gives you the point at which you can clear the session? Make it part of the log out process. Then as long as the page checks the session info the problem is solved.

Granted if the browser caches the history there may not be a refresh of the page but perhaps the problem is being overstated as Markus said.

nathj