in reply to Re^2: How do you do sessions in Web Sites
in thread How do you do sessions in Web Sites

Just remember that if you use POST for every page, depending on their browser (mis)configuration or browser (mis)behaviour, you will basically break the browser "Back" button.

It's going to ask the user every time s/he hits "back" with that annoying message, "do you want to re-submit this form?", and the users will probably be confused and not know what to do. :(

  • Comment on Re^3: How do you do sessions in Web Sites

Replies are listed 'Best First'.
Re^4: How do you do sessions in Web Sites
by awwaiid (Friar) on Sep 29, 2005 at 00:23 UTC

    Very good point. On plus side of useability for always-post, you get all the data they are currently working on.

    Imagine a page with navigation bar at the top and a user is filling out the form. Even the navigation bar secretly uses POST buttons/links. Since we always POST, we even get their partially filled form so that when they click 'Home' or something we can ask 'Are you sure you want to leave the form half-completed' and keep all their data and everything.

    But the back button thing does freak people out.

[reply]
      Yeah, the back button thing is a long-standing hate of mine. Opera manages to work around this by just caching the pages. When you go back, it opens the page from the cache. Perhaps in a small number of cases this is somehow wrong and you need to refresh (in which case, the 'Refresh' button usually does the trick) but 99% of the time, this just works, is useful, and lets you usefully look back at data in, for example, multipage sign up/purchase forms without having to continually repost.

      It completely baffles me that the other major browsers don't do this.

      Cheerio!
      Osfameron
      http://osfameron.perlmonk.org/chickenman/

[reply]

        You can actually set up the caching headers such that most browsers (ie/firefox at least) will cache Everything. You can do this by adding the header "Cache-Control: cache". I think.

        One idea I had (and tested successfully) is to use always-cached pages along with some javascript to do fancy things. JS gets re-executed, but gets to keep some variables (so you can tell that you've already been viewed). You can also do those fancy xmlhttprequest thingies.

        So most of the time when you go back it just shows you the page. But you could also have your js ask the server if it is OK to re-display this particular page, and then display a message (or nuke the page through DOM or whatever) if its not OK. That way they can't mess with you much if the go back to a one-time page --- a "are you sure you want to delete X" page or "Are you sure you want to charge 1 million dollars to your credit card?"

        I give each page I display its own unique ID, so it would be easy to just keep a server-side list of which pages to "expire" or invalidate.

        As always, however, Javascript is helpful for useability and does nothing for security.

[reply]

In Section Seekers of Perl Wisdom