Security issue, can navigate to previous pages even after logged out of session

[jcs224]

I think this has to do with the way Inertia saves props in the history.pushState, but I'm able to navigate back and forth on pages even after I'm logged out, and see all the data in their full glory. Is there some way to force a refresh after logged out after a session?

[adamwathan]

This is actually true of all server rendered applications, and just the way the browser works by default.

Try it here on GitHub even for example 👍🏻

[jcs224]

Oh man you're right.. just tried it with a different Laravel app with normal pages, and it happens there too. I guess I'll have to find some other way to get around this. The reason I'm concerned about this is because this app will likely be used in a computer lab with lots of different users with their own sensitive data, where they might log out but not close the browser.

FYI, GitHub doesn't seem to have this issue. Logged out and navigated back, forced a page refresh.

[adamwathan]

Weird, happens for me on GitHub! But yeah pretty normal browser behavior unfortunately for your case :/

[jcs224]

@adamwathan Well, FWIW, I did solve this particular issue for me as best as I could figure out. It was a little more difficult than normal, because my logout made an Inertia request instead of a full page reload. So, I did two things.

1. A regular, non-Inertia Axios call and then used JavaScript to load the login page:
2. Added middleware in Laravel to not cache HTML responses at all, but leave any other request alone (including Inertia)

// Inertia code
axios.post('/logout').then(() => { window.location.href = '/login' })

// Laravel middleware
public function handle($request, Closure $next)
    {
        $response = $next($request);

        if (strpos($response->headers->get('Content-Type'), 'text/html') !== false) {
            return $response->header('Cache-Control','no-cache, no-store, max-age=0, must-revalidate')
            ->header('Pragma','no-cache')
            ->header('Expires','Sun, 02 Jan 1990 00:00:00 GMT');
        } else {
            return $response;
        }
    }

This means that upon logout, it will remember that the HTML the app is loaded in is not cached, and the back button will try to reload the page rather than just take the cached page. The middleware alone would work for a normal Laravel app, but this didn't apply with Inertia because the logout didn't do a full page reload.

[gregupton]

Just out of curiosity are you using the auth/guest middleware to protect your routes?

[jcs224]

@gregupton yep, using guest middleware for the login page and request, and auth middleware for the rest of the pages.

It turns out that @adamwathan is right about this being standard behavior, even for non-Inertia apps, which freaked me out. The standard solution to this issue is to just apply the above middleware, which works when all the pages are regular, server-rendered Blade pages or whatever. But with Inertia I had to force the page to fully reload upon logout so that a different user couldn't just sit down and hit the back button, seeing the previous page.

[drfraker]

After looking into this myself I've made a few discoveries.

1. Github does not have the behavior that @adamwathan mentions when you test the behavior on private repos.
   You can test this by going to github signing in and navigating to a private repo that you own. Then log out. Click the back button and you will see a 404 page.
2. You can definitely prevent back button issues on web apps where you need higher security by using Cache-Control headers.
3. You can test this by adding a header to your response 'Cache-Control': 'no-cache, no-store', visit a page then click the back button and you will see a full page refresh.

The full page refresh happens because the headers tell the browser it must not cache pages and get the page from the server every time. This is how you can make web apps more secure when necessary.

However, it doesn't seem that Inertia is taking this into account when it makes its ajax calls. I think it should. I wonder if this issue should be reopened so we can explore a solution?

I've opened a new issue #247 to discuss this further.

[RedFoxxxxx]

Hello everyone, does anyone have a work around on this? I also noticed this behaviour and I was not able to find any solutions.

[finestgecko]

It has been over a year since this was last active... has anyone figured out a solution to this?

I tried setting a bunch of headers like Cache-Control, Pragma and Expires and then doing a window.location.refresh() after logging out, but it doesn't seem to have any effect.

[RedFoxxxxx]

Hello, I was able to solve this using the suggestion of @reinink here #247. You might wanna read on it and try to apply on your project.