Closing Browser upon Logging out

Question

Hi all,
As the so many others who posted ( and still do) voicing their concern regarding the security whole that allows users to simply click the back button to see previously displayed data. I understand they won't be able to do anything without getting prompted by the login screen again, but the fact they can see it is scarey enough. I hope this thread puts this issue to rest at least if I can summarize it, suggest the different options available, and lead prospective inquirers in the right direction. Having read all related threads in this forum, I was disappointed to see replies either circumvente, ignore, or invalidate the issue altogether. The button line is there is no proposed solution (step by step) on how to prevent this other than generic suggestions that are probably none applicable any way.
I would like to challenge the experts in this forum to respond in a conclusive manner explaining a solution on a step by step basis (e.g. Oracle by example) approach. Form what I've seen, I can either unset the session cookie and close the browser window. Or, I can use some metadata tags somewhere in the page template to expire browser cache. I prefer to do this without closing windows, but I will be content if I'm shown how to do it.
I know expiring browser cache is doeable because our PeopleSoft application and my bank does it without closing my browser.
Again, for the htmldb experts among us, step in and show us your muscles!!!

Answer 1

Thanks for those who took the time to reply. The meta tags did not work. I tested it in FFox and IE with no luck. However, in the process of researching this issue. I came up with these different options. It looks like this can be done on the server and client side. I will start with client side options.
1) Use of Meta tags.
This option is widely mentioned on the net. I've seen some posts indicating that not all browsers support it. This option did not work for me in FFox or IE. The suggestion is to insert these tags in the header section of the page you want to disable going back to:
<meta http-equiv="Expires" CONTENT="0">
<meta http-equiv="Cache-Control" CONTENT="no-cache">
<meta http-equiv="Pragma" CONTENT="no-cache">
2) Froce forward on the page
Simple (not necessarily fool-proof) but works. By putting this code in the page template header section I practically disabled 'BACK' button on all pages in the application. You can selectively put in any page you want to disable going back to. Any way, you really do not need the 'BACK' button since all branching is taken care off using items you specify.
<script language="JavaScript">
<!--
javascript:window.history.forward(1);
//-->
</script>
3) Replace current page in history.
The idea here is to disable logging the current page in the browser history. This way, user can not go back to this page. I was able to get this to work making my own page and I liked it. But I was not able (or did not know how) to get it to work with the LOGOUT link in HTMLDB. This method works when a user branches out from page A to B using a link in A. I tried using a link of my own to replace HTMLDB default logout navigator link. It worked, but I was not able to unset the cookie along with it. If you know how, please share with us.
No back button when you do this.
you can see an this implemented here http://www.4guysfromrolla.com/webtech/111500-1.2.shtml
4) Close browser upon logging off.
Last resort. I got it to work in IE but not FFox. In the later, you can not close window unless it was opened from the same script. I did not mind this method, it is just I never got it to work in FFox.
Finally, I've see some server side code to expire pages ,but I really did not have time to play with it yet.
I used the method I liked the least, but it worked. If you know how to implement any of the others, please share.
You can get more details here http://www.4guysfromrolla.com/webtech/111500-1.shtml.
Thanks.