Friday, December 21, 2012

How to prevent back button from showing data after logout

In a secure web application where user has to login to see contents, it is not desirable that previous page(s) can be seen using browser's back button after a user has logged out. This can happen if you allow caching for your secure pages. The solution is easy. You need to set the cache-control and expiration date headers for your secured pages. The expiration date should be set to a past date so that it expires immediately. Here is an example:
Cache-Control: no-cache
Expires: Fri, 31 Dec 1990 12:00:00 GMT

No comments:

Post a Comment