Security

[Indu]

Hi,

I have an application which runs with secure access. User logs in,
uses the services, and logs out. After logging out, if the user click
the back button, it actually takes them to that page. How can I
prevent this?

Is there a way, that if the person clicks the back button or access a
browser history, how can I make sure that the latest page is displayed
instead of just the cache. Or, clicking the back/history should
refresh that page.

If this is in any FAQs, could anyone direct me to the right one.

thanks,

Indu

 

[Thomas 'PointedEars' Lahn]

I have an application which runs with secure access. User logs in,
uses the services, and logs out. After logging out, if the user click
the back button, it actually takes them to that page. How can I
prevent this?

Use POST requests and server-side sessions.

Google is your friend. [psf 6.1]


PointedEars

 

[Indu]

I am using POST request, and server side sessions. When you click
back/next buttons on the browser, no request is made, and the browser
shows the page.

Is there a way to refresh/reload the page when a person clicks a back
button?

thanks,

Indu

 

[Evertjan.]

Indu wrote on 30 jan 2006 in comp.lang.javascript:

I am using POST request, and server side sessions. When you click
back/next buttons on the browser, no request is made, and the browser
shows the page.

Please quote what you are replying to.

If you want to post a followup via groups.google.com, don't use the
"Reply" link at the bottom of the article. Click on "show options" at the
top of the article, then click on the "Reply" at the bottom of the article

Is there a way to refresh/reload the page when a person clicks a back
button?

No.

 

[Thomas 'PointedEars' Lahn]

I am using POST request, and server side sessions. When you click
back/next buttons on the browser, no request is made, and the browser
shows the page.

Not here.

Is there a way to refresh/reload the page when a person clicks a back
button?

No.


PointedEars

 

[Thomas 'PointedEars' Lahn]

don't use HTTP for your security. (implement a login form...)

That is not possible with a Web application. HTTPS, which you probably
mean, is merely HTTP over SSL/TLS.


PointedEars

 

[Thomas 'PointedEars' Lahn]

no, not what I mean at all, I mean don't use HTTP authenticcation. use a
login form and a server based session.

However, this recommendation is not well founded. In fact, HTTP
Authentication provides less attack points than server-side programming
does, and it does not require server-side programming. Both approaches
have their drawbacks, of course.

Still, I wonder how you got the idea that the OP is using HTTP
Authentication in the first place.


PointedEars