Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ‘navigate’ back to this entry using back button, the browser notices that the content has already expired so it prompts with information that the content has expired and asks to resubmit the request to get the ‘updated’ version of that page from the server. Once user click the retry/refresh button then this forms data is passed back to server and treated as a normal login request. Thereby allowing user to login to application using cached credentails of previously logged-out user. What are the possible ways to prevent caching of input request data ?

share|improve this question
    
+1 Glad this question was asked. Reposting login creds on page refresh just renders the entire authentication system broken. –  Shivam Oct 8 '12 at 22:23
add comment

1 Answer

That should never happen.
Without any code samples which I can look it, one reason I can envision that happening is an authentication workflow as shown below:

In the following diagram, /login POSTs to /member, where the authentication check takes place.

If authentication passes, the pages continues to send the 'logged in user' content. This makes this page (/member) appear into browsers history. Anytime you click back/forward button on your browser to come to this page, it will ask you if you want to POST the form content on this page. In this case, the date is login credentials.


  WRONG WAY:

  +---------------------------+          +------------------------------+
  |   Login Page (/login)     |          |   Member Page(/member)       |
  |---------------------------|          |------------------------------|
  |          +--------------+ |          | if creds wrong               |
  | UserName |              | |          |   redirect_to /login         |
  |          +--------------+ |+-------->| else                         |
  |          +--------------+ |          |   "Welcome Back,             |
  | Password |              | |          |    Here is your super secret |
  |          +--------------+ |          |    member area where you can |
  |                           |          |    check out the cool stuff" |
  +---------------------------+          | end                          |
                                         +------------------------------+

Instead you should have this kind of authentication flow:

  • Login page posts to a /verify (or /auth whatever you call it) page.
  • The verification page does not have any http output. Based on whether the creds are good or bad it just redirects to the appropriate page. If login is good, it sets a cookie flag indicating a valid session.
  • Member page validates the session by checking the cookie value and redirects to /login page if session is expired/not-set.

In this workflow, /verify page never appears in the browser history and there is no way user can 'click refresh' on that page to trigger POST data getting sent again.

   CORRECT WAY                POST        +-----------------------------+
                            +------------>| Verify page (/verify)       |
                            |             |-----------------------------|
  +-------------------------+-+           | if creds wrong              |
  |   Login Page (/login)     |<---+---------+redirect_to /login        |
  |---------------------------|    |      | else                        |
  |          +--------------+ |    |      |   set_session_cookie        |
  | UserName |              | |    | +-------+redirect_to /member       |
  |          +--------------+ |    | |    | end                         |
  |          +--------------+ |    | |    |                             |
  | Password |              | |    | |    +-----------------------------+
  |          +--------------+ |    | |
  |                           |    | |      +------------------------------+
  +---------------------------+    | +----->|   Member Page(/member)       |
                                   |        |------------------------------|
                                   |        | if session_cookie not set    |
                                   +-----------+redirect_to /login         |
                                            | else                         |
                                            |   "Welcome Back,             |
                                            |    Here is your super secret |
                                            |    member area where you can |
                                            |    check out the cool stuff" |
                                            | end                          |
                                            +------------------------------+

This is the common Post/Redirect/Get model. You can check this wiki page for prettier pictures: http://en.wikipedia.org/wiki/Post/Redirect/Get

Also, if you want to prevent the browser to cache certain HTML pages, you can set the cache-control HTTP header to 'no-cache' for those pages.

Cache-Control: no-cache

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.