# Mozzila Logout back button issue

**URL:** <https://www.ruby-forum.com/t/mozzila-logout-back-button-issue/109931>\
**Category:** Rails\
**Created:** [July 20, 2007, 12:10pm UTC](https://www.ruby-forum.com/t/mozzila-logout-back-button-issue/109931 "2007-07-20T12:10:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhinton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@mhinton](https://www.ruby-forum.com/u/mhinton)\
**Post date:** [July 20, 2007, 12:10pm UTC](https://www.ruby-forum.com/t/mozzila-logout-back-button-issue/109931/1 "2007-07-20T12:10:54Z")

</div>

Hello,

I have recently created an application in Rails which makes use of a  
login and logout system. I have a user controller and model as well as a  
login controller. My login controller performs my logout and login  
functions. The user is a scaffold of my database table and is auto  
generated from rails.

def process\_login  
#Creates the user with the form variables i have not included the  
code  
#here to create the user cause its not necessary  
if logged\_in\_user  
session[:user\_id] = logged\_in\_user.id  
flash[:notice] = ‘You have been logged in.’  
redirect\_to(:controller =\> ‘admin’, :action =\> “index”)  
else  
flash[:notice] = ‘Invalid user and or password combination’  
redirect\_to(:controller =\> ‘login’, :action =\> ‘index’)  
end  
end

def logout  
session[:user\_id] = nil  
reset\_session  
flash[:notice] = ‘You have logged out successfully’  
redirect\_to(:controller =\> ‘login’, :action =\> ‘index’)  
end

#This method is specified private in my ApplicationController  
#which is inherited by my controllers  
def authorize\_access  
if not session[:user\_id]  
flash[:notice] = “Please log in.”  
redirect\_to(:controller =\> ‘login’, :action =\> ‘index’)  
return false  
end  
end

Basically in a nutshell this is my problem. A user clicks the logout  
link which then directs him to the Login form through this command  
redirect\_to(:controller =\> ‘login’, :action =\> ‘index’) which works 100%  
and it resets the session. HOWEVER when the user clicks the back button  
it still shows him the users index page or the page the user logged out  
from. Even after specifying the before\_filter :authorize\_access option  
in my controllers. The interesting thing to note is This ONLY happens in  
Firefox (they are able to click back and view the “protected page”) In  
I.E this works 100%.

Anyone got ideas ?

---

<div class="post-metadata">

**Author:** ![mhinton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@mhinton](https://www.ruby-forum.com/u/mhinton)\
**Post date:** [July 20, 2007, 12:20pm UTC](https://www.ruby-forum.com/t/mozzila-logout-back-button-issue/109931/2 "2007-07-20T12:20:28Z")

</div>

may be the webpage is cached in firefox?  
If you try to refresh the webpage (after clicking the back button) what  
happens?

---

<div class="post-metadata">

**Author:** ![mhinton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@mhinton](https://www.ruby-forum.com/u/mhinton)\
**Post date:** [July 20, 2007, 12:34pm UTC](https://www.ruby-forum.com/t/mozzila-logout-back-button-issue/109931/3 "2007-07-20T12:34:25Z")

</div>

The page directs me to the logout if I refresh after clicking back or  
try click any of the links in the admin page I logged out from. It looks  
like the webpage is cached in firefox however even after clearing my  
browsers cache, history and authenticated sessions this still happens

Do you have a suggestion on what I can try ?

---

<div class="post-metadata">

**Author:** ![mhinton](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/8edcca/32.png) [@mhinton](https://www.ruby-forum.com/u/mhinton)\
**Post date:** [July 20, 2007, 12:35pm UTC](https://www.ruby-forum.com/t/mozzila-logout-back-button-issue/109931/4 "2007-07-20T12:35:55Z")

</div>

I meant to say it directs me to the Login Page if i refresh…