Logout

[hartzoua]

Hi,
i am new in PHP and i have some problems. The website i am trying to create has a login page and works with sessions. When the user wants to logout, he goes to another page where i have the code:
session_start();
$_SESSION = array();
session_destroy();

After that the session is destroyed. My problem is that if i press the button "Back" here , i will be able to see the content of the previous page. I dont't like it! Have i done something wrong? Can i do something to prevent the user of seeing the main page after loged out? (the ideal would be to get him to the login page again)
Thank you

[jatar_k]

Welcome to WebmasterWorld hartzoua,

If the page is cached there isn't really much you can do if they go back. If you are already authenticating the user on each page and it still shows then you are kind of stuck.

You can send no-cache headers but even then it may still show the page on Back. At least if they try to go anywhere from there they will be thrown back to the login page.

When they logout do you send them off to the login page now?

[hartzoua]

Thank you Jatar_k,
I erased the cache header and now it works fine. When they log out i send them to one other page and when they try to get in without session i send them to the log in page.
When you say "authenticating the user in each page" what exactly do you mean? To try to match at the beggining of every page the session elements that i get with the ones that i have in the database? If i do this, won't my website become too slow?
Thanks a lot

[jatar_k]

not so much testing them a against the db every time just testing that essential sessions vars are there and that they aren't empty. If they aren't there then they are once again banished to the login page and we destroy the session.

for example if you store username and accountid in the session and need them to be there all the time. On each page you can include a base auth like so

<? include "/mylibs/auth.php";?>

auth.php

<?
if (!isset($_SESSION['username']) ¦¦!isset($_SESSION['account_id'])) {
unset($_SESSION);
header("Location: /login.php");
}

something like that

[hartzoua]

Thanks a lot,

Till now everything works perfectly. But i'm afraid you 'll have news from me soon! :)