Show Login after User Logsout and Press Back button

Question

It's quite common that when User is logged out and pressing back button may land into LoggedIn user pages [last page], though they will not be able to do anything from there. But certainly it can be seen as Logged in User page.

One way is to ensure that browsers don't cache the page, setting up header parameters. But it can work or can't work depending on browser.

When I have seen Facebook, somehow they implemented this feature that once user is logged out, back button will always asks for login.

How do we achieve this using Javascript/jQuery?

Answer 1

This method depends somehow on how you implement your "isLoggedIn" function on the server side.

But let's say you can control cookies and you are setting a cookie LoggedIn=true when an user is logged in and delete this cookie with the logout function.

Then it's as simple as

if( ! readCookie( 'LoggedIn' ){
    alert( "you are not logged in" );
    document.location = "/your_login_page.html";
}

where the readCookie function is taken from here: http://www.quirksmode.org/js/cookies.html#script

The same method can be done with session-ids of cause as long as you delete the session on logout.

Answer 2

First of all your server side script should be that much efficient that user cannot grab any information after logout like expiring cookie, unsetting $_SESSION variable, etc.

I am not writing the exact script but you need to write something like this:

<script>
<META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<META HTTP-EQUIV="Expires" content="-1">
<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-STORE">
<script language="javascript" type="text/javascript" >
window.history.forward();
if(window.history.forward(1) != null)
      window.history.forward(1);
</script>

And for displaying alert box on current page:

<script language="javascript" type = "text/javascript" >

   function preventBack()
   { 
     alert("You can't navigate to the previous page.You need to go again to the Login page!")
   }

    setTimeout("preventBack()", 0);

    window.onunload=function(){null};

</script>