log out page with codeigniter

Question

I'm learning codeigniter. After a user logs in when he clicks on the log out button he goes back to the login page, but if he clicks on the browser back button he goes back to the connection page again. So the session is kept in the browser. How to redirect to the login page instead.

code

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
class User extends CI_Controller{
public function __construct()
{
    parent::__construct();

    $this->load->model('user_model');

}
 public function index()
{

    if($this->session->userdata('logged_in'))
    {
        $session_data = $this->session->userdata('logged_in');
        $data['nom'] = $session_data['nom'];
       redirect('user/connection_Ok');
    }
    else
    {
        //If no session, redirect to login page
        $this->login;

    }

}
public function logout()
{
    $this->session->unset_userdata('logged_in');
   // session_destroy();
    $this->session->sess_destroy();
 redirect('login');

}

thanks for your reply i would to return to the login page again if user clicks on the browser back button just after log out. It — baptpro
Please note that I turned my previous comments into an answer. — Sparky

Sparky Sparky · Accepted Answer · 2016-05-18T23:24:54

when he clicks on the log out button he goes back to the login page, but if he clicks on the browser back button he goes back to the connection page again. So the session is kept in the browser.

I think there's some confusion here... if he clicks "logout", your logout controller destroys the session, period. Using the browser's "back" button cannot reverse this action or restore his session.

In other words, just because the cached page "looks like" he's still logged in, does not mean he is still logged in. As soon as he tries to access restricted content, he will not be authorized since his previous session was already destroyed.

How to redirect to the login page instead.

You can't stop users from clicking the browser's "back" button, nor can you easily control what happens when they do. The browser simply loads the cached version of the previous page without reloading it... it's just how browsers work.

JavaScript will give you access to things like browser history, but there is no perfectly reliable method for intercepting the "back" button. No matter how comprehensive or complex the solution, the user can simply disable JavaScript and defeat it.

However, if you program a robust authorization system, the user will automatically be taken to a login page anytime they try to access restricted content without being logged in.

FYI - for CodeIgniter, I recommend you use a proven authorization system so you don't have to reinvent the wheel or worry about security. I like Ben Edmund's Ion Auth, but there are a few other solutions out there for CodeIgniter... just do your research.

log out page with codeigniter

2 Answers