防止用户访问只能通过登录获取的数据的最佳方法是什么？

Question

I am using a publicly made login to test and modify, however no matter what I do when a user logs out, they are able to log right back in by using the back button in their browser, refresh the page, and still be logged in. What is the best way to prevent this? I am new to PHP and am in the process of learning. Any help would be greatly appreciated.

You can find all of the files necessary here: https://github.com/devplanete/php-login-advanced.

You can also test it here: http://www.php-login.net/demo3.html

Answer 1

I think that there are only 2 possibilities that are wrong. First you do not delete the cookies and the sessions properly which makes the user is not logged out.

Secondly, you don't check on the page they try to access if the user is logged or not.

Update: As said above in the comments, you need to separate your login form treatment from the index page if you want not the user to be able to re log again from the logout page by pressing back key. Your template is currently index.php => index.php login treatment then displaying You need to do index.php => login.php login treatment => redirect back to index.php