using session variable to maintain login, but what about logout?

[spewn]

I'm using session to password protect a section of my website.

works great. i even have a log out that sets the session variables to blank as opposed to "loggedin" and the user is returned to the log in page.

however, if i hit the back button, i'm shown the members only section. if i hit the refresh, i'm prompted that the information needs to be resent (page cannot be refreshed without resending the info, etc) and that logs them right back in.

i've tried session->flush, clear, delete but to no avail. i set a variable to logged out, but then the can't log back in without creating a new session.

i can't figure out how to create a new session when they log out, so there's no way to back button their way back in.

any ideas or better way?

- g

 

[travs69]

This is a browser problem not a session problem.
The browser is caching what is being seen to re-show the user. Even if they can hit the back button they shouldn't be able to do anything as everytime they click on something you should be checking for the active session.

The only real solution is a ajax type solution where you have a javascript on the web page that calls a perl script. The web page will retry the javascript when reloaded and re-run the perl side of things.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis - Those Who Say It Cannot Be Done Are Usually Interrupted by Someone Else Doing It; Give the wrong symptoms, get the wrong solutions;

 

[spewn]

what do you mean "active" session? when the page refreshes, it resends the page as it is and makes the session active again...

as far as the ajax, i'll look it up. that's new to me.

i was reading last night and it looked as if i might be able to clear the cookies, thereby clearing the session, but i don't know how to add the cookie clearing to my script...

- g

 

[travs69]

On every page you should be checking for a valid session and if there isn't one you should be sending the person to a login type page(or error page.. or something).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis - Those Who Say It Cannot Be Done Are Usually Interrupted by Someone Else Doing It; Give the wrong symptoms, get the wrong solutions;

 

[travs69]

As for the back button in the browser we get that question here every 2-3 weeks. If done right.. even if a person can see the info they won't be able to do anything.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis - Those Who Say It Cannot Be Done Are Usually Interrupted by Someone Else Doing It; Give the wrong symptoms, get the wrong solutions;