Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options
 
PerlMonks  

perl CGI::Session not deleting the session

by chandrakanth (Initiate)
on Feb 20, 2015 at 10:08 UTC ( [id://1117307]=perlquestion: print w/replies, xml ) Need Help??

chandrakanth has asked for the wisdom of the Perl Monks concerning the following question:

Hi All,
Scenario: Page1->Page2->Page3/logout
Here is my logout.pl script.
<font size=19> $cgi = CGI->new; $sid = $cgi->cookie("CGISESSID") || undef; $session = CGI::Session->load($sid); $session->delete();
Now even after this, if i click the browser back button, the session still exists. I'm able to view the Page2. Whereas Page two also checks if session exists or not, I'm seeing the same session id on page2.

How can i delete the session completely so that if the user click back button, there should not be any session. And the user should get redirected to Page1.

Thanks in advance for any inputs. Regards, Chandu

Replies are listed 'Best First'.
Re: perl CGI::Session not deleting the session
by Anonymous Monk on Feb 20, 2015 at 11:31 UTC

    Your code example contains a mix of HTML and Perl, what's up with that?

    Now even after this, if i click the browser back button, the session still exists. I'm able to view the Page2.

    Are you sure the browser isn't just showing you a cached version of the page? Many modern browsers now have "web developer tools", which you can use to see if your browser is actually making a request to the server or not. In any case, you can get your CGI script to kindly ask the browser not to cache the page, see e.g. here.

    If you find that the session really does still exist, then have a closer look at the documentation and other threads on this matter. For example, you may want to call $session->flush() after delete; other places suggest that simply $session->clear() is enough - note that a session existing is not necessarily the same as a user being logged in within that session.

      Are you sure the browser isn't just showing you a cached version of the page?
      >> To confirm this i just created a hyperlink to Page4 on the logout page. On page4 also i had the script to check if a session exists or not.. i'm seeing the same session id on Page4 too.

        You said you see the same session ID, which is not surprising since you're getting it from a cookie - or did you delete the cookie too? I think there is still some confusion here: Did you check if the session got deleted, such as by looking into the data store that holds the sessions, or by checking whether the session is empty or not? Also, are you equating a session existing with being logged in? Why do you need to delete the session, why isn't clearing it enough to effect the logout?

Re: perl CGI::Session not deleting the session
by Anonymous Monk on Feb 21, 2015 at 00:32 UTC
      If the other two scripts aren't behaving, why blame the logout script?
      >>If Logout script is working fine, then i should not see the same session id on the newly created Page4, right.

      CGI::Session directly which means you're not using a helper like CGI::Application ... which means you probably got that part wrong :)
      >>I don't see anything wrong in the script, i just followed the CPAN tutorial and crated this. Moreover i just need a simple script to logout the user by deleting a session.
Re: perl CGI::Session not deleting the session
by sundialsvc4 (Abbot) on Feb 23, 2015 at 01:46 UTC

    One thing that you need to be careful to do, upon logout, is to break the user’s Back-button sequence.   You should be able to do this by sending him a redirect.

    As others have suggested, it really helps to use a Perl framework that’s designed to do as much of the overall work as possible.   For example, http://www.cgi-app.org/index.cgi?LoginLogoutExampleApp has a complete example of a tiny CGI::Application site ...   It is fairly uncommon to see folks these days using CGI::Session directly.

    The trouble is that Back will often hand you a cached copy of a previously displayed page.   But, the server is no longer in-sync with what it says:   the server now thinks that you have logged off, and, if you actually try to do anything with the cached page, you’ll discover that you have.   If you look at things using the debugger that’s built into your web browser, you’ll probably found that the web client didn’t send anything to the host when you pressed Back and it (merely) redisplayed the page.   You’ll probably find that you can go Back and Forward and see that, as you do, nothing new is being sent to the host.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: perlquestion [id://1117307]
Approved by GotToBTru
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others learning in the Monastery: (4)
As of 2024-04-26 01:13 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found