Prevent user from seeing pages that require a session

Question

I've got a login page then I made a link to a page called logout and it contains this code:

logout.php

<?php

session_unset();
session_destroy();
header("Location:");

?>

Yet when I log out then hit the back button it takes me back. How do I change it so that it ask you to login again before showing you your previous page?

Answer 1

On the page you're going back to (or any page for that matter) you need to do checks to see if the user is logged in or not (i.e. has a valid session) and if not, redirect them to the login page.

Additionally, it might help for you to add some no-caching headers to this particular piece of code.

Answer 2

You have not set any location to redirect to.

Should be:

 header("Location:http://example.com/login.php");

This way when you logout, it will redirect the browser to login.php.

EDIT:

Also, it would help to add a session validation condition to your main page.

Somenthing like:

 if(!isset($_SESSION))
 {
     header("Location:http://example.com/login.php");
 }