Hi,

Hope this is the right place, but I'm developing a web app using PHP, and I have run into a possible security flaw.

Basically when the user logs out, they are redirected to the sign in page. However if they press the back button, they can see the last page again.

If they were to click refresh it would be logged out, but the browser cache is displaying the static page. I have used headers to expire the page, and it seems to work in all browsers except safari (win+mac).

 

I wondered if anyone knew how to solve this?

 

 

Thanks

see if this helps

 

 

http://www.hunlock.com/blogs/Mastering_The_Back_Button_With_Javascript

Thanks, looks like it should work, will try it out tomorrow. +1