Unfortunately, even with no-cache and expires headers (have you checked to make sure these are put in correctly and in the right place?) the browser is free to ignore them; most browsers will converse bandwith by bringing up the cached version of the page instead of resending the information.
But the solution of checking the sessionID verses the user's ID and their logged-in status (all which you should be maintaining in this case) will work; assuming that any links from the main back (the one you're trying to prevent people from going back to) are through other CGI scripts for your site; what you should do is not necessarily delete the sessionID but tag it as 'completed', and leave it in whatever storage medium you have for some reasonable period of time (on the order of hours). When a user visits a page, you should check the sessionID: if no sessionID exists, ask them to log in; if a sessionID exists and is still open, continue as usual. If a sessionID exists and is marked closed, ask the user again to log in to access that information.
Dr. Michael K. Neylon - mneylon-pm@masemware.com
||
"You've left the lens cap of your mind on again, Pinky" - The Brain
| [reply] |