I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the browser (assume a Kiosk environment )
Then and a second (malicious) user approaches the terminal and then hits the back button or simply browses the history.
As a result, the malicious user is able to view content they are not authorized for.
What are my options for preventing this?
What can I do to keep the site "user friendly" and allow authenticated users to go back though history, but not unauthenticated/unauthorized ?
Some ideas I was playing with include
- Cache-Control: no-cache
But I'm unsure how these various settings will be affect a Web Browser when operating in an SSL or non SSL mode. This gets even more complicated if a proxy is involved, hence I decided it would be wise to check in with the experts.