Preventing Web Site Users From Using Their Back Button To Get To Cached Screens After Logging Out?

Question

I have a legacy Java webapp ( Spring 3.1 MVC, legacy servlest and JSPs ) I have modified to log the user out after s/he clicks an external link to leave the web site.

The last screen(s) s/he was on are getting cached in the browser, enabling them to see some data by hitting their back button.

I could put no-cache headers into those screens, and it works, but the site was poorly designed with multipage forms, some with one result screen doing post requests to get to another screen.

If those screens aren't cached, a user hitting his/her back button will find themselves on a blank page going backwards and forwards leaving him/her nowhere with no other choice except to login again. A bigger mess.

Short of redesigning a site is there anything else I can do to prevent the user from using his/her back button, after logging out to get to cached screens?

I tried having the user go to a static redirect screen after logging out in the hope that s/he would just get bounced back to the external URL when using their back button, but at least two browsers don't appear to cache or navigate to such pages.

Any ideas would be welcome.

I am able to use javascript as well as server side code.

Even if I can't solve this problem, I may learn something for the future

Thanks

Steve

Answer 1

Any checks on the user side cannot replace checks on the server. If your server can suffer from request with obsolete data (logged off user, or something like that), doing tricks with user's browser history is not a solution to the problem, but only dust in the eyes.

Also, user can save page and load it later from file. Some browsers and/or extensions even allow to save non-static content (generated by JavaScript after page load).

Answer 2

So the page isn't cached but the user still has a history of pages they can "back" button to which just turns up blank pages? I assume if the user makes any request to the server it will redirect them to a log-in page.

It might be easiest rather than refusing to cache pages, to allow caching but a) to really ensure your forms cannot be resubmitted when they have been submitted once and b) to use a Javascript check against the cookies in the browser when the page is loaded, to ensure that they have a current session.

If you wanted to be fancy, you could use a bit of ajax to check the session Id with the server ( assuming you haven't just timed the session out when they left the page ) but you might also be able to set a "logged-out" cookie when you are unsetting the session and just check for that value.

You can also use Javascript to interact with the browser history as well, but this is a little bit newfangled- MDN has the lowdown. I wouldn't like to say whether you could do anything to adjust the browser history on logout so the user can be sent back to somewhere more friendly, but it may be worth looking into.