Hammy has asked for the wisdom of the Perl Monks concerning the following question:

Hello, I am not sure if this question belongs here, but I am at a loss. I have a dynamic, secure site written entirely in Perl. When one of my clients uses the back button anywhere on the site, they get

'The page you requested was created using information you submitted in a form. This page is no longer available. As a security precaution, Internet Explorer does not automatically resubmit your information for you.'

They do not get this on any of their other secure sites. The only information I can find when searching is - tell them to clear their cache, or change some setting dealing with encrypted pages. Since other sites do not have this problem, I was hoping there is a switch or a header I could use to get rid of this problem. Has anyone ever experienced this before?

Thanks in advance!

Replies are listed 'Best First'.
Re: page expired message
by Tuppence (Pilgrim) on Jan 03, 2005 at 17:13 UTC

    This is actually a feature of the web browser that is saving you from having duplicate information. Form submissions are usually task processing in nature, which means for instance that if someone hits 'back' from your order confirmation page if the web browser resubmitted your form in all likelyhood it would generate a new order (now duplicate) and take you to the confirmed order page for the new order.

    This doesn't really have anything to do with the fact that it is a secure site. If you redirect at the end of every form handler, you will not have this problem. This does however make report filtering type forms a bit more difficult, but that situation would be one of the few where a method="get" form would be an appropriate choice.

[reply]
[d/l]
      Yea, this has nothing to do with perl or his code. It is either a setting on the server or IE. It's just saying that you shouldn't use "back" to resubmit a form. Just modify your script to forward the user to a new page once the form processes instead of outputting a html page.
[reply]
      Pardon my ignorance, but what do you mean - redirect at the end of every form handler. The way my page is created, I build the page from several places. I basically create a print statement that puts out the header, the dynamic middle part, and the trailer. There is never really an html page except the one I am creating.

      Each page has a menu structure surrounded by a form that calls a main script (index.cgi) that builds the next page. So no matter what page you go to on my site, you are at index.cgi and it builds your output.

      Is there a way around this with my methodology? Thanks.
[reply]

        I mean that every time a user clicks a submit button to submit a POST form, you follow these steps:

        1. Handle the form. This means creating the order, flipping the status field on your table, or whatever
        2. Redirect to a status page. This might need some massaging of variables to be passed along the request line in order to get enough information to say what happened, but it will remove the flaw in your page-to-page flow.

        This all stems from HTML not being meant to contain state information, and having that bolted on leaves a few rough edges such as this one.

        If this is still unclear please say so and I'll try to come up with a fleshed out example

[reply]
        More a workaround than a solution, but...
        Add a big label that says "Do not use your back button" in the header (or in each script producing the "dynamic" content
        PLUS
        build into your footer a link to something reasonable. Use standard .html if you're using a HERE for the footer; quote and escape VERY carefully if your footer is comprised of a bunch of

        print "<p>something....</p>";
print "<p>something else...</p>";"
print "<p><a href='path/to/something/reasonable...'>something reasonab
+le</a></p>";
print "</body></html>";

        [download]

        where "something reasonable" is your home "page," the top "page" in the section from which the submit calls the cgi, etc.

[reply]
[d/l]
Re: page expired message
by r34d0nl1 (Pilgrim) on Jan 03, 2005 at 18:28 UTC
    Have you setted a expiration time? Maybe checking the header sent to the browser would help.
    If you are using the cgi module you would add the -expires parameter to the header() method, like 
    print $query->header(-type=>'image/gif',
                     -nph=>1,
                     -status=>'402 Payment required',
                     -expires=>'+3d',
                     -cookie=>$cookie,
                     -charset=>'utf-7',
                     -attachment=>'foo.gif');

    [download]
    You can see a deeply explanation by checking perldoc CGI
    I hope it could help
[reply]
[d/l]
      I do not have any expirations set. Also, I can not reproduce this problem. It is only one client and sporatic clients elsewhere. Is there a way I can force the message to be skipped? I will try to find the info in perldoc, I just have not been successful so far with my searches.
[reply]

        As this is a client-side message, you will be able to do nothing on the server to fix it aside from fixing your page flow and not displaying pages directly from POSTed form content.

        FYI, the mozilla version of this error is the pop-up box that says something about clicking OK will re-submit this form possibly causing an action to be repeated

[reply]

Back to Seekers of Perl Wisdom