Posted by crescent_au on 11/01/06 10:39

Michael Fesser wrote:
> >People can just go back
> >and access the pages inspite of being logged out.
>
> Of course they can go back in the browser history, but if they're logged
> out they shouldn't be able to do anything on that expired page anymore.
>

In my case, when I press the browser's back button, it takes me to the
previous logged-in screen. In addition to that, the previous session,
token and IP are also stored in the database. I think this shouldn't
happen once the database is cleared of these entries when logged out.
Any thoughts?

[Back to original message]