Another logout problem

[NateUNI]

I have looked through past topics on this scenario, but have not been able to solve the problem. My problem is that when a person logs out they are still able to click the back button and continue to use the site. I am using session variables, not cookies. These are my files:

Application.cfm
<cfapplication name=&quot;PurchaseOrder&quot;
SessionManagement=&quot;yes&quot;
SessionTimeOut=&quot;#CreateTimespan(0,0,30,0)#&quot;
SetClientCookies=&quot;no&quot;>

<!---Path variables (you may need to change these)--->
<cfset UserDSN=&quot;po&quot;>

<CFIF NOT IsDefined(&quot;Session.LoggedIn&quot OR NOT IsDefined(&quot;Session.Group_Level&quot>
<CFSET Session.LoggedIn=False>
<CFSET Session.Group_Level=&quot;&quot;>
</CFIF>

<CFIF Session.LoggedIn EQ False>
<CFIF NOT (CGI.PATH_INFO EQ &quot;/purchaseorder/login.cfm&quot>
<CFLOCATION url=&quot;login.cfm&quot;>
</CFIF>
</CFIF>

<CFIF NOT (CGI.PATH_INFO EQ &quot;/purchaseorder/login.cfm&quot>
<cfinclude template=&quot;LogOutTemp.cfm&quot;>
</CFIF>


LogOutTemp.cfm
<a href=&quot;LogOut.cfm&quot;>Logout</a>

LogOut.cfm
<cfset Structclear(session)>
<CFLOCATION url=&quot;login.cfm&quot; addtoken=&quot;no&quot;>
<meta http-equiv=&quot;REFRESH&quot; content=&quot;1; url=login.cfm&quot;>

Thanks!!!!

 

[webmigit]

I had the same problem, and this worked for me, people can't backtrack through member pages if this is in the header for the page.

<cfheader NAME=&quot;Expires&quot; VALUE=&quot;Mon, 06 Jan 1990 00:00:01 GMT&quot;>
<cfheader NAME=&quot;Pragma&quot; VALUE=&quot;no-cache&quot;>
<cfheader NAME=&quot;cache-control&quot; VALUE=&quot;no-cache&quot;>

Tony

 

[NateUNI]

Unfortunately that did not do the trick, any other suggestions?? Thanks!

 

[webmigit]

Try changing the corresponding paret of the above to:

  <CFIF NOT IsDefined(&quot;Session.LoggedIn&quot;) OR NOT IsDefined(&quot;Session.Group_Level&quot;)>
      <CFSET Session.LoggedIn=0>
    <CFSET Session.Group_Level=&quot;&quot;>
  </CFIF>

  <CFIF Session.LoggedIn EQ 0>
          <CFIF CGI.path_info IS NOT &quot;/purchaseorder/login.cfm&quot;>
            <CFLOCATION url=&quot;login.cfm&quot;>
        </CFIF>
  </CFIF>

<CFOUTPUT>#cgi.path_info#</CFOUTPUT> for debugging

 

[NateUNI]

didn't work

 

[webmigit]

Wait Duh, I bet both are CFPARAMMED right? Session.loggedin and Session.Group_Level?

 

[NateUNI]

no they are not CFPARAMMED anywhere, this is my login page if it helps, Thanks

<script language=&quot;JavaScript&quot;>
function setfocus(){
document.form1.UserName.focus();
}
</script>

<!---Set up the variables--->
<cfparam name=&quot;UserName&quot; default=&quot;&quot;>
<cfparam name=&quot;Password&quot; default=&quot;&quot;>
<cfparam name=&quot;ErrorMessage&quot; default=&quot;&quot;>
<cfparam name=&quot;ShowForm&quot; default=&quot;yes&quot;>

<!---Proccess This Form--->
<cfif isdefined(&quot;Form.login&quot>

<!---Server side error check the form fields (Turn off for CF4.0)--->
<cfloop list=&quot;#Form.FieldNames#&quot; index=&quot;ThisField&quot;>
<cfif Form[ThisField] is &quot;&quot;>
<cfset ErrorMessage=ListAppend(ErrorMessage,ThisField & &quot; is a required field&quot>
</cfif>
</cfloop>

<!---Check for error messages--->
<cfif Not Len(ErrorMessage)>


<!---check user/form data--->
<cfquery datasource='#UserDSN#' name='Login'>
SELECT FirstName,LastName, UserName, Group_Level
FROM PO_User
WHERE UserName='#Form.UserName#'
AND Password='#Form.Password#'
</cfquery>


<!---Authenticate user--->
<cfif Login.RecordCount EQ 1>
<cfoutput>
<cfset Session.Group_Level=&quot;#Login.Group_Level#&quot;>
<cfset Session.LoggedIn=&quot;True&quot;>
<cfset Session.FirstName=&quot;#Login.FirstName#&quot;>
<cfset Session.LastName=&quot;#Login.LastName#&quot;>
<cfset Session.UserName=&quot;#Login.UserName#&quot;>
<cfset Session.AutoToken=&quot;?CFID=#Session.CFID#&CFTOKEN=#Session.CFTOKEN#&quot;>
<cfset Session.XXAutoToken=&quot;&CFID=#Session.CFID#&CFTOKEN=#Session.CFTOKEN#&quot;>
</cfoutput>

<!---Don&quot;t bother showing Form again--->
<cfset ShowForm=&quot;No&quot;>

<!---Assuming Login.RecordCount is NOT 1--->
<cfelse>
<cfset ErrorMessage=ListAppend(ErrorMessage,&quot;Sorry, that UserName/Password was invalid&quot>
</cfif>

</cfif><!---End Error Check--->
</cfif><!---End Form Proccessing--->

<!---Display Login Form--->
<cfif ShowForm is &quot;Yes&quot;>
<link href=&quot;css.css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;>
<html>
<body ONLOAD=&quot;setfocus()&quot;>


<!---Display Error Message(s)--->
<cfif IsDefined(&quot;ErrorMessage&quot>
<cfloop from=1 to=#ListLen(ErrorMessage)# index=index>
<cfoutput>#ListGetAT(ErrorMessage,index)#<br></cfoutput>
</cfloop>
</cfif>

<cfoutput>
<!---You must get &quot;fresh&quot; CFID values for this form--->
<form action=&quot;#getfilefrompath(getcurrenttemplatepath())#&quot; method=&quot;post&quot; name=&quot;form1&quot;>
<table>
<tr>
<td>UserName
</td>
<td><input type=&quot;text&quot; name=&quot;UserName&quot; value=&quot;#UserName#&quot; size=50>
</td>
</tr>
<tr>
<td>Password
</td>
<td><input type=&quot;password&quot; name=&quot;Password&quot; value=&quot;#Password#&quot; size=50>
</td>
</tr>
<tr>
<td colspan=2 align=center><input type=&quot;submit&quot; name=&quot;login&quot; value=&quot;login&quot;>
</td>
</tr>
</table>
</form>
</cfoutput>


</body>
</html>

<!---Success (ShowForm=&quot;NO&quot--->
<cfelse>

<cfoutput>
<META HTTP-EQUIV=Refresh CONTENT=&quot;0; URL=Menu.cfm#Session.AutoToken#&quot;>
</cfoutput>

</cfif>
<!---End ShowForm--->

 

[webmigit]

OK, before:

  <CFIF NOT IsDefined(&quot;Session.LoggedIn&quot;) OR NOT IsDefined(&quot;Session.Group_Level&quot;)>
      <CFSET Session.LoggedIn=False>
    <CFSET Session.Group_Level=&quot;&quot;>
  </CFIF>

run this:

<CFOUTPUT>#IsDefined(&quot;Session.LoggedIn&quot;)# #IsDefined(&quot;Session.Group_Level&quot;)#</CFOUTPUT>

. See if you get what you expect, which sould be False False.

 

[webmigit]

Ok, when you log out a user out, use structclear(session); as you do but allso set Session.LoggedIn to like... 0.. And then in application.cfm when checking to see if someone is logged in, check to see if it is 0. If it is so, cflocate them to the login page..

Also you ought to look into CFLOCKING Session Variables and since you haven't yet done that, might as well get the next recommended step done and save a lot, not all of your CFLOCKING. Read my FAQ on it: faq232-1926.

Also, once we get it working, and we will, you'll still want to keep the cfheeader tags, using these, once a user is logged out, they cannot backtrack.. thus maintaining account security on shared computers.

Tony

 

[csteinhilber]

If CFTOKEN and CFIF are in the URL of the page that they're going back to, you might have a problem, too... those parameters on the query string are basically telling ColdFusion the user is &quot;logged in&quot; (or, more appropriately, that it should track the user under the session it's set up for them).

Hope it helps,
-Carl

 

[NateUNI]

when i put this in my application.cfm
<CFOUTPUT>#IsDefined(&quot;Session.LoggedIn&quot# #IsDefined(&quot;Session.Group_Level&quot#</CFOUTPUT>
I get Yes Yes.
I also tried your other suggestions to set Session.LoggedIN to 0 and that did not work.

In response to csteinhilber, is there any way not to use CFTOKEN and CFIF if you would want to maintain sessions??

Thanks for all the help!!

 

[imstillatwork]

In response to csteinhilber, is there any way not to use CFTOKEN and CFIF if you would want to maintain sessions??

Yes, you can use a cookie that contians the Token and ID,
that way you neve have to pass them through forms or urls.

 

[csteinhilber]

imstillatwork is right

Set &quot;SetClientCookies&quot; to &quot;Yes&quot; in your CFAPPLICATION tag, instead of &quot;No&quot;, and the CFTOKEN and CFID are automatically passed to the browser.

I know that you said you're not using cookies, but client cookies are not traditional cookies (for proof, set your browser to prompt you any time it is asked to accept a cookie - in IE5 it's part of the security levels, in IE6 it's in privacy, in Netscape4 it's in &quot;Advanced&quot;, in Netscape6 it's in &quot;Privacy & Security -> Cookies&quot; - then hit a page/app that's set to use client cookies and you'll see the browser doesn't think they're cookies at all). There's virtually no way for the user to disable them... which is the main objection most developers have with cookies.

At any rate, the more I played with it, the more I realized that that probably won't fix your problem anyway

I think it has more to do with the fact that you're using CFLOCATIONs... which don't actually make true requests, and monkey with the browser history and session variables anyway.

Could you maybe use CFINCLUDEs, instead of CFLOCATIONs? I'm thinking something like (simplified and probably pseudo code):

index.cfm

<HTML>
<HEAD>
    <TITLE>My security system</TITLE>
    <META HTTP-EQUIV=&quot;content-type&quot; CONTENT=&quot;text/html;charset=iso-8859-1&quot;>
    <META HTTP-EQUIV=&quot;Expires&quot; CONTENT=&quot;0&quot;>'
    <META HTTP-EQUIV=&quot;Pragma&quot; CONTENT=&quot;no-cache&quot;>
    <META HTTP-EQUIV=&quot;Cache-Control&quot; CONTENT=&quot;no-cache&quot;>

</HEAD>
<BODY>
<CFIF IsDefined(&quot;URL.page&quot;)>
   <!--- a &quot;page&quot; was passed in the query string --->
   <CFIF isLoggedIn>
      <CFSET okayToViewPage = true>
      <CFINCLUDE template=&quot;#URL.page#&quot;>
                :
   <CFELSE>
      <!--- show form --->
                :
   </CFIF>
</CFIF>
</BODY>
</HTML>

included_page.cfm

<!--- no HTML, HEAD or BODY tags... just the content --->
<CFPARAM name=&quot;okayToViewPage&quot; default=&quot;false&quot;>
<CFIF okayToViewPage>
     <!--- show page here  --->

<CFELSE>
     <H1>Please login first</H1>

</CFIF>

So the only way you could view a page is through a &quot;gatekeeper&quot; (index.cfm). And, hopefully, using CFINCLUDE will allow the page to expire, and the session variables to maintain their correct values.

Also, as a side benefit... since you'd be including the pages, you might not need session variables at all, because any page that is included from index.cfm would automatically inherit index.cfm's variables.

ie-
index.cfm

<CFSET myVar1 = &quot;grep&quot;>
<CFSET myVar2 = &quot;fubar&quot;>
<CFINCLUDE template=&quot;myinclude.cfm&quot;>

myinclude.cfm

<!--- included page can utilize the parent's variables --->
<CFOUTPUT>#myVar1#<BR />#myVar2#<BR /></CFOUTPUT>

<CFOUTPUT>
Hope it helps,
-Carl