且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

阻止后退按钮暴露安全页面?

更新时间:2023-12-02 23:10:22

如果您可以使用 HTTPS,那么结合 Cache-control: no-cache 标头将禁用页面缓存"(内存中/后向缓存的 WebKit 术语).这样做的缺点是它会被所有安全页面视图禁用,而不仅仅是在注销后.(来源;注意他们正在允许例外,值得关注这一点.)

If you can use HTTPS, this combined with a Cache-control: no-cache header will disable the "page cache" (the WebKit term for in-memory/back-forward cache). The downside of this is that it will be disabled for all secure page views, not just after log out. (Source; note they are working on allowing exceptions, it's worth keeping an eye on this.)

如果您可以依赖 JavaScript,附加 unload 事件处理程序将阻止页面缓存".这样做的好处是还允许您仅在单击注销"按钮或链接时破坏缓存,然后才附加 unload 事件处理程序.(来源)

If you can depend on JavaScript, attaching an unload event handler will prevent the "page cache". This has the benefit of also allowing you to only break the cache when a "log out" button or link is clicked, by only then attaching the unload event handler. (Source)

这些解决方案都不是理想的,但其中一个可能是值得的妥协.

Neither of these solutions are ideal, but one of them might be a worthwhile compromise.