Member Avatar for aditi_19

Hi,

I have created logout.php page which destroys all the session variables. Basically i want the the user to get directed to the Login page after logout button is pressed. But when the BACK button of the browser is pressed(even after logout), the user is still able to see other web pages.

How can i always direct Back button of the browser to Login page if the user has logged out?

  • 2 Contributors
  • 2 Replies
  • 223 Views
  • 18 Hours Discussion Span
  • Latest Post Latest Post by aditi_19

Dani AI

Generated

Good call by to handle access on the server side — the browser Back button can’t be reliably forced to go to a specific URL. What you need is two things: (1) always verify the session on every protected page, and (2) prevent browsers/proxies from serving a cached copy of those pages so the server check actually runs when a user navigates Back.

Add non-caching headers to every protected page (before any output):

<?php
header("Expires: Tue, 01 Jan 2000 00:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
?>

Use a complete logout that fully clears server session data and removes the session cookie so the session check can’t be bypassed:

<?php
session_start();
$_SESSION = array();
if (ini_get("session.use_cookies")) {
    $p = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
}
session_destroy();
?>

After destroying the session, send the user to your login page. Make sure all protected pages perform the session check at the very start (so cached copies are useless) and that headers are sent before any HTML output — or use output buffering.

Troubleshooting: test in a private/incognito window and inspect the Network tab to confirm the no-cache headers are present. Also set session cookie flags (Secure, HttpOnly) and call session_regenerate_id() at login to harden sessions. With ’s server-side check plus the cache headers and proper logout above, pressing Back after logout will cause a fresh request that falls back to the login flow — which is what observed when it worked.

Recommended Answers

All 2 Replies

Member Avatar for Member #120589

Don't try to code the BACK button, instead, use something like this at the head of every page:

if(!isset($_SESSION['login']))header("Location: ");

Although you could use a relative or even absolute reference with header, I think I read somewhere that you should use the full url. Would cause a problem if testing both locally and remotely though. You could use:

if(!isset($_SESSION['login']))header("Location: {$_SERVER['HTTP_HOST']}/login.php");

to enable the same code to run on local, testing and remote servers

However, I've used absolute references in the past without any ill effects, but I guess some other contributors here could give you good reasons why you shouldn't do this.

Member Avatar for aditi_19

Hey,

Thanks a lot. It worked fine !

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.