Question

I have an issue with my Rails application and the browser’s cache: When a user logs out of the authenticated section of the site, they are still able to use the back button on the browser to see the authenticated page. I do not want to allow this.

How can I expire the cache and force it to reload.

Thank you

Answer 1

The following headers should do that. Whatever page you’re trying protect, add them there.

Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: "now"
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache

Obviously, the now needs to be dynamic.