Logout not really logging out?

[glenschild]

Hi all

I have set up a logout.a5w page containing the following code (as seen by searching on here!)

<%a5 a5ws_logoutuser(session,request,response) %>
<%a5 response.redirect("index.a5w") %>

I have a navigation menu which has a "logout" option which navigates to the logout page and all seems to work okay in so much as I end up back at the main login page (index.a5w) BUT I can use the "back button" to go back to the previous page? So I guess that the session variables set during login have not been cleared?

Am I doing something wrong?

Regards

Glen

[EricN]

Re: Logout not really logging out?

Have you tested to see if your session.variables still exist when you hit the "back button?"

I have this in my logout page:
a5ws_logoutuser(session,request,response)

dim session.__protected__userid as c = ""
dim userid as c = ""
dim session.Company_name as c = ""
dim session.First_name as c = ""
dim session.last_name as c = ""
dim session.permissions as c = ""
response.redirect("LogoutConfirm.a5w")

The logoutconfirm page confirms the logout and displays the "Welcome Guest" line (see pic 2) proving that the session variables = "" May be overkill but works for me.

[Steve Wood]

Re: Logout not really logging out?

Mine is similar to Eric's, but I use session.reset() which DELETES all session variables (except some system ones). The users session is NOT necessarily expired when they log out or even close the browser. It times out based on what the server is set to in config on the Sessions tab.

Logout or closing the browser does not affect the users session.

None of this has anything to do with why your user can press the back button and see their information. They ARE logged out, and if they pressed refresh on that page, they would get redirected to your Index page (most likely). They can see information only because it is in their page history.

I don't think you can use javascript to delete history but you can disable the back button. Imagine if a browser could delete your history! You'd be very mad if it did. So if you wrote that into your application, nobody would talk to you ever again.

I have not done this yet, but I know some systems will insert a dummy last page, sort of a passthrough page or pages so t that the back button DOES NOT take them to anything important, it takes them to this blank page. I don't know how my bank does it, but the back button takes me to an "expired page" everytime.

[glenschild]

Re: Logout not really logging out?

Thanks Eric and Steve

All sorted. I will probably redirect after login to an "expired" page which then redirects back to the login page. That way if the user clicks the back button it will go back to the expired page and may stop some people at that point. Probably worth a try.

Regards

Glen

[harrison4411]

Re: Logout not really logging out?

I am using your session.reset() in my logout code and the Browser back button contiues to use the navagator.

My Code in head of Logout.a5w page.
<%a5
a5ws_logoutuser(session,request,response)
session.reset()
response.redirect("Index.a5w")
%>

Attached screen shot after logout and using back button displays this screen shot.

Also what is and how do you use the expired web page ?

Thanks for any info of how to clear the browser back button after log out.