Re: Help how to disable the Back Button in the browser

TMTOWTDI. If you're making a session ID already, then you're almost there. You need to take it one step further. Here's the concept:

Make a session ID (*Done already*)
Record that ID in a file with the IP address, and time stamp (EPOCH or something.)
When the user goes to a new page, make sure to send along the current session ID (Hidden field or populate the URL location bar... whatever)
Check that session ID against the session ID, IP address etc. in the file that you logged to make sure that they exist. If they don't exist, then make them log in.
Make a new session ID.
Delete their old session ID and record their new session ID.

If you want to allow for just one back button, then simply record the past "two session id's." This is not necessarily elegant, but it gets the job done. (Actually the credit to this method belongs to fenonn.)

- Mission

"Heck I don't know how to do it either, but do you think that's going to stop me?!!"

Comment on Re: Help how to disable the Back Button in the browser

Replies are listed 'Best First'.
Re: Re: Help how to disable the Back Button in the browser by merlyn (Sage) on Jun 26, 2001 at 05:02 UTC
Do not use IP address to determine anything about a visitor. -- Randal L. Schwartz, Perl hacker	[reply]
Re: Re: Re: Help how to disable the Back Button in the browser by eejack (Hermit) on Jun 26, 2001 at 16:01 UTC
What my terse associate means is ip addresses may not be particularly meaningful or usable in a medley of cases, such as AOL users (dynamic ip allocation via their proxy), accumulating connections (office buildings going out through a single ip address), and spoofed connections. It is safer and easier to do without them. EEjack	[reply]