codeigniter sess_destroy() not working properly,what m i doing wrong?

Question

I am a newbie in codeigniter. I am using an an login form to login as an admin. When the admin logs in with the correct user name and password s/he is directed to the home page with a session variable.and then if he clicks the log out button the session is supposed to be destroyed and redirect the user to log in page i.e log in form page.

The 1st controller is admin:

<?php
class Admin extends CI_Controller
{
    function index()
    {
        $data['main_content'] = 'admin/log_in';
        $this -> load -> view('includes/admin/admin_template', $data);
    }
    function log_in()
    {
        $this->load->model('admin_model');
        $query = $this -> admin_model -> validate();
        if ($query)// if the user's credentials validated...
        {
            $data = array('user_name' => $this -> input -> post('user_name'), 'is_logged_in' => true);
            $this -> session -> set_userdata($data);
            redirect('admin/home/admin_home');
        } else// incorrect username or password
        {
            $this -> index();
        }
    }
    function log_out()
    {
        $this->session->sess_destroy();
        redirect('/admin/admin','refresh');
    }
}

The second controller is the home controller:

<?php
class Home extends CI_Controller
{
    function __construct()
    {
        parent:: __construct();
        $this->is_logged_in();
    }
    function is_logged_in() 
    {
        $is_logged_in = $this -> session -> userdata('is_logged_in');
        if (!isset($is_logged_in) || $is_logged_in != true)
        {
            $this -> load -> view('admin/forbidden');
        }
    }
    function admin_home()
    {
        $data['main_content'] = 'home_view';
        $this->load->view('admin/home_view');
    }
}

The model is admin_model:

<?php
class Admin_model extends CI_Model
{
    function __construct()
    {
        parent:: __construct();
    }
    function validate()
    {
            $this->db->where('user_name',$this->input->post('user_name'));
            $this->db->where('password', $this->input->post('password'));
            $query = $this->db->get('user');
            if($query->num_rows==1)
            {
                return true;
            }
    }
}

Now, it supposed the user to logout and destroy the session, but if I click the back button of my browser I can get page back which was supposed not to be and the session is not destroyed. please tell me what I am doing wrong here. I am using codeigniter 2.1.0.

Answer 1

after going through all the troubles and searching in various places i have finally found a proper solution to this question.the problem arrived because the browser was showing the cached pages.it was not the session that was creating the problem and it was working properly. here is the solution: in the home controller adding a function to clear the cache and calling it in the constructor function does the trick :) here is the home controller with the solution:

<?php
class Home extends CI_Controller
{
    function __construct()
    {
        parent:: __construct();
        $this->is_logged_in();
        $this->clear_cache();
    }
    function is_logged_in() 
    {

        if (!$this->session->userdata('is_logged_in'))
        {
            redirect('/admin/admin');
        }
    }
    function clear_cache()
    {
        $this->output->set_header("Cache-Control: no-store, no-cache, must-revalidate, no-transform, max-age=0, post-check=0, pre-check=0");
        $this->output->set_header("Pragma: no-cache");
    }
    function admin_home()
    {
        $data['main_content'] = 'home_view';
        $this->load->view('admin/home_view');
    }
}

now thanks goes to this link " logout feature in code igniter ",here is where i have found the solution and it works perfectly :)

Answer 2

If you logout then although the session is destroyed, the session userdata remains for the duration of the current CI page build.

As a precautionary measure you should do:

function log_out()
{
    $this->session->sess_destroy();
    // null the session (just in case):
    $this->session->set_userdata(array('user_name' => '', 'is_logged_in' => ''));

    redirect('/admin/admin');
}

See: http://codeigniter.com/forums/viewthread/110993/P130/#662369