如何在ColdFusion中注销后结束会话

Question

我在我的应用程序中使用CFML。我需要帮助开发一个销毁会话的注销操作。现在，在注销链接上我正在调用登录页面，但是当点击浏览器上的BACK按钮时，用户仍然登录。

<!---LoginForm.cfm>--->

<!---Handle the logout--->

<cfif structKeyExists(URL,'logout')>
    <cfset createObject("component",'authenticationService').doLogout() />
</cfif>
<!---Form processing begins here--->
<cfif structkeyExists(form,'submitLogin')>
    <!---Create an instane of the authenticate service component--->
    <cfset authenticationService=createObject("component",'authenticationService') />
    <!---Server side data validation--->
    <cfset aErrorMessages=authenticationService.validateUser(form.userEmail,form.userPassword)>
    <cfif ArrayisEmpty(aErrorMessages)>
        <!---Proceed to the login procedure --->
        <cfset isUserLoggedIn=authenticationService.doLogin(form.userEmail,form.userPassword) >
    </cfif>
</cfif>
<!---Form processing ends here--->
<cfform>
    <fieldset>
    <legend>Login</legend>
    <cfif structKeyExists(variables,'aErrorMessages') AND NOT  ArrayIsEmpty(aErrorMessages)>
        <cfoutput>
        <cfloop array="#aErrorMessages#" index="message" >
            <p >#message#</p>
        </cfloop>
        </cfoutput>
    </cfif> 
    <cfif structKeyExists(variables,'isUserLoggedIn') AND isUserLoggedIn EQ false>
        <p class="errorMessage">User not found.Please try again!</p>
    </cfif>
    <cfif structKeyExists(session,'stLoggedInUser')>
        <!---display a welcome message--->
        <p><cfoutput>Welcome #session.stLoggedInUser.userFirstName# </cfoutput>
        <p><a href='#'>My profile</a><a href="LoginForm.cfm?logout">Logout</a></p>
    <cfelse>
        <dl>
        <dt>
            <label for="userEmail">Email address</label>
        </dt>
        <dd>
            <cfinput type="email" name="userEmail" required="true" >
        </dd>
        <dt>
            <label for="userEmail">Password</label>
        </dt>
        <dd>
            <cfinput type="password" name="userPassword" required="true" >
        </dd>
        </dl>
        <cfinput type="submit" name="submitLogin" value="Login" />
        </fieldset>
    </cfif>
</cfform>
<cfdump var="#session#">


<!---authenticationService.cfc--->
<cfcomponent>
    <cffunction name="validateUser" access="public" output="false" returntype="array">
        <cfargument name="userEmail" type="string" required="true" />
        <cfargument name="userPassword" type="string" required="true" />
        <cfset var aErrorMessages=ArrayNew(1) />
        <!---Validate the email--->
        <cfif NOT isValid('email',arguments.userEmail)>
            <cfset arrayAppend(aErrorMessages,'Please,provide a valid email address') />
        </cfif>
        <!---Validating the Password--->
        <cfif arguments.userPassword EQ ''>
            <cfset arrayAppend(aErrorMessages,'Please, provide a password') />
        </cfif>
        <cfreturn aErrorMessages />
    </cffunction>
    <!---doLogin() Method--->
    <cffunction name="doLogin" access="public" output="false" returntype="boolean">
        <cfargument name="userEmail" type="string" required="true" />
        <cfargument name="userPassword" type="string" required="true" />
        <!---create the isUserLoggedIn variable--->
        <cfset var isUserLoggedIn=false />
        <!---get the user data from the database--->
        <cfquery datasource="myapp" name="getInfo">
            select * from Info 
            where emailid='#form.userEmail#' and password='#form.userPassword#'
        </cfquery>
        <!---Check if the query returns one and only one user--->
        <cfif getInfo.recordcount eq 1 >
            <!--- log the user in --->
            <cflogin>
                <cfloginuser name="#getInfo.username#" password="#getInfo.password#" roles="#getInfo.role#">
            </cflogin>
            <!--- save user data in session scope --->
            <cfset session.stLoggedInUser={'userFirstName'=getInfo.username} />
            <!---change the isUserLoggedIn variable to true--->
            <cfset var isUserLoggedIn=true />
        </cfif>
        <!---return the isUserLoggedIn variable --->
        <cfreturn isUserLoggedIn />
    </cffunction>
    <!---doLogout() Method--->
    <cffunction name="doLogout" access="public" output="false" returntype="any">
        <!---delete user from session scope--->
        <cfset structDelete(session,'stLoggedInUser') />
        <!---log the user out--->
        <cflogout />
    </cffunction>
</cfcomponent>

Answer 1

关于注销后的后退按钮，情况是有人可以在不关闭浏览器或锁定它的情况下注销并离开他们的计算机。然后其他任何人都可以返回他们的浏览器并查看他们在退出之前查看的数据。

我们通过在每个页面请求上实现Pragma: no-cache标头来解决这个问题。这会强制要求页面从服务器重新加载，而不仅仅是加载浏览器缓存中的内容。这意味着后退按钮将从服务器请求以前的URL，该URL将检查会话并将您带到已注销的登录页面。

它会摒弃一些习惯于以某种方式浏览您网站的用户，但这会让它更加安全。