Preventing users to go back to a secure page by using the back buton

[goldfidget]

@siteguru

But if you go to a another page/website and then click the BACK button, is the REFERER even set? My quick test below suggests not.

<?php
echo 'Referrer is ' . $_SERVER['HTTP_REFERER'] . '<br>';
?>
<a href="http://www.google.co.uk">Go to Google</a>

Edit: other posts above came in while I was testing.

Thanks for doing the test siteguru If the referrer is unset then so much the better, just check for that, and don’t ship the page if the referrer is not your domain.

[system]

@siteguru

But if you go to a another page/website and then click the BACK button, is the REFERER even set? My quick test below suggests not.

<?php
echo 'Referrer is ' . $_SERVER['HTTP_REFERER'] . '<br>';
?>
<a href="http://www.google.co.uk">Go to Google</a>

Edit: other posts above came in while I was testing.

yep, referer is not being set either when I click my back button.

looks like aleksejs’ ssl solution would be the way to go for this scenario.

[system]

@goldfidget

Thanks for doing the test siteguru If the referrer is unset then so much the better, just check for that, and don’t ship the page if the referrer is not your domain.

but what if the user is still on your website when they hit the back button and simply want to go to the previous page on your website.

wouldn’t they then be logged out because there was no referer?

[rpkamp]

@Kalon

wouldn’t they then be logged out because there was no referer?

Correct. Forget I ever said referrer and go for Aleksejs’ solution; it’s way better!

[carlos_10111]

@rpkamp

If your bank kicks you out if you copy paste a URL in a new window/tab they’re probably also use the HTTP_REFERER.

Have you looked at the $_SERVER[‘HTTP_REFERER’] to see what value it contains? Once you do I think my idea will become clear to you very soon

where do you want me to check for this? just give me an idea how to go about this. thanx

[rpkamp]

@carlos_10111

where do you want me to check for this? just give me an idea how to go about this. thanx

See above ^

@rpkamp

Forget I ever said referrer and go for Aleksejs’ solution; it’s way better!

[goldfidget]

@Kalon

but what if the user is still on your website when they hit the back button and simply want to go to the previous page on your website.

wouldn’t they then be logged out because there was no referer?

That happens on my bank (coop) If you hit the back button it says “don’t hit the back button” and logs you out…

[carlos_10111]

@Kalon

@carlos_10111

let me try and summarise what scallioXTX suggested

1. every time a user accesses one of their login pages, in addition to your normal login validation you also check what url the user has just come from via $_SERVER[‘HTTP_REFERER’]

2. if the value of $_SERVER[‘HTTP_REFERER’] is not on a list of your website’s valid url’s then that means the user has just come from a url not on your website and so you then log them out.

ok that i get, but in the example i gave you of the bank, i was on the same website i did not change site, as in the example of going to google and come back.

[system]

@rpkamp

Correct. Forget I ever said referrer and go for Aleksejs’ solution; it’s way better!

yep looks like it.

sounded good in theory but I realised after siteguru’s test that it’s not so reliable in practice

[I]yep, referer is not being set either when I click my back button.

looks like aleksejs’ ssl solution would be the way to go for this scenario.[/I]

[Aleksejs]

I just read whole thread more throughly. I think my suggestion will not prevent the following scenario:

If I understand correctly, then the requirement is that I can not do this:
Log into MySite, copy URL, go to OtherSite, paste URL, once again get access to MySite.

In my opinion you can do that only if you implement some sort of AJAX heartbeat… While opened page constantly reports, that user is still active via AJAX. If user leaves this site, then server detects, that there is no response from user and invalidates any session that has skipped (say) 3 times the heartbeat interval (for instance, heartbeat could update last_active session variable). Depending on how your heartbeat functionality is implemented, you can make sure, that only user that has never left page has the correct heartbeat values.

[system]

@Aleksejs

I just read whole thread more throughly. I think my suggestion will not prevent the following scenario:

If I understand correctly, then the requirement is that I can not do this:
Log into MySite, copy URL, go to OtherSite, paste URL, once again get access to MySite.

oh dear, my head is starting to :weyes:

I thought that is exactly what the op wants to not happen.

I’m going to

[Aleksejs]

2 Kalon:
the requirement is that I can not do this:
(~;

Using multi negatives is such a fun, isn’t it?

[carlos_10111]

ok guys, i thought this was an easy thing to do, but from your replies i realise it’s a bit tricky! i will try all your sugestions and which one will work. i would appriciate if any of you can just try your theories as well just to make sure there are feasible.
I think this is a great thread, thanx for all the inputs!

[goldfidget]

@Aleksejs

2 Kalon:
the requirement is that I can not do this:
(~;

Using multi negatives is such a fun, isn’t it?

Wow, lost and lost.

So the user can not cut and paste a URL and get access to the site. In that case the referrer is still a good way to go, as in this case the referrer would be blank. The back button would be broke, but that would be good, you don’t want people clicking back into your site if they sit down at your computer after you’ve left.

[goldfidget]

@divinequran

Hi,

I think you can do it by using javascript,

window.history.forward(1);

write it as a function and do a function call as <body onLoad=“function_name”>

True, but javascript will give you no security. Turn off the script in the browser and you’ve turned off the security.

[siteguru]

Except that the referrer is a HTTP header, in which case it can be spoofed.

I think the reality is that multiple levels of checking/security are needed to cater for all (known) eventualities.

[divinequran]

Hi,

I think you can do it by using javascript,

window.history.forward(1);

write it as a function and do a function call as <body onLoad=“function_name”>