secure logout

[phlow]

i want to create a secure logout. but when i use session_destroy() it seems to be not safe: when i afterwards click "back" and than "refresh", i see the page containing all the session variables that should be destroyed. i even used session_unregister() - with the same effect.

there must be a better way to do that, right?

[MrAlaska]

session_destroy should be safe, are you unsetting the variables? If so, you might be dealing with a caching issue, they can get nasty when using the ol' back button.

http://www.php.net/manual/en/function.session-destroy.php

From the PHP manual
<?php

// Initialize the session.
// If you are using session_name("something"), don't forget it now!
session_start();
// Unset all of the session variables.
session_unset();
// Finally, destroy the session.
session_destroy();

?>

[phlow]

yeah, i did it like the examply in the php manual. to me it seems to be some kind of cach problem, too. i think it's not very dangerous, but anyway i'd like to fix it, so if anyone has any suggestions, please don't hesitate do post them, thanx in advance, Phlow.