security problem

rengy

i am doing a web complaint system which require user to login. the session is created when register and destroy when they logout.
i meet a problem where afetr the i login to the system, when i click BACK to the login page; i am able to click FOWARD to enter again the system without require the login cause the session is still remain, can anyone gives me some clues on how to slove this security problem?

dalecosp

This kind of depends on why this situation is a problem.

Perhaps a "no-cache" header would help.

OTOH, this would be a behavior I would expect, due to the way sessions work. Why is this a security issue? If they've passed the login, then they are obviously a user who should be allowed access... why would they need to login again?

rengy

hmmm what i mean is when the user click on back to the previous page(lets says the homepage which require no login), and i am able to enter the system again without login (just click the foward button). is this not a security problem?

if the user din close the browser and left, other people might access to the page as well. am i right?

is that means "relogin" after the user click back to previous page which require none login is not neccessary?? because i figure out Yahoo and hotmail is able to back and foward between the login and none login page...

drawmack

The only thing you can do is log them out every time the main page loads, however I don't see the problem.

I come to the site, I log in, I press the back button to read something on the main page, I go back to the registered user's area.

If I close my browser then I won't be able to do that.

rengy

alright i get what you mean now. it is normal if the user can access between login and nonlogin page after they have been login. i think i just border too much with the 'security' of the system.
thx for helps!