CodeIgniter back button after logout

Question

I'm trying to stop/disable the back button functionality of the browser when a user logs out of my CodeIgniter (PHP) app. But, I think the browser is caching the page so it becomes visible despite the session being destroyed from logout.

I know the session is dead because when the user tries to do anything (click any link etc) they are kicked out through the methods in my controller.

It's not ideal to have the back button working in this manner since the previous page contains confidential information.

Not a clue how to tackle this one, maybe a redirect page in between (but then the user could slam the back button really quick right?), help!

Thanks.

Solution 1

Add this to prevent caching of the previous page:

header("cache-Control: no-store, no-cache, must-revalidate");
header("cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");

Solution 2

I think this could help you out, it works for me.

CodeIgniter Framework version:

$this->output->set_header('Last-Modified:'.gmdate('D, d M Y H:i:s').'GMT');
$this->output->set_header('Cache-Control: no-store, no-cache, must-revalidate');
$this->output->set_header('Cache-Control: post-check=0, pre-check=0',false);
$this->output->set_header('Pragma: no-cache');

PHP version:

header('Last-Modified:'.gmdate('D, d M Y H:i:s').'GMT');
header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: post-check=0, pre-check=0',false);
header('Pragma: no-cache');

if you are using PHP OOP put the above code in your constructor to initialize on your pages.

Solution 3

My solution for this problem:

1. Check that the cookie is set will with an if.
2. Step parameters and call the login method of user model.
3. Finally charge the corresponding views.

If the cookie is not set will redirected to the login page.

if(isset($_COOKIE['ci_session'])){ 
  $user= $this->security->xss_clean($this->input->post('user'));
  $pass= $this->security->xss_clean($this->input->post('pass'));

  $result = $usrLog->loguearUsuario($user, $pass);

  if($result == TRUE){
     $data = $this->session->set_userdata('logged_in', $sessArray);
     $this->load->view('pages/admin', $data);
  }

}else{
   header('Location: login'); 
}

I hope you learn! And sorry for my english! :-)