注销后如何重定向到Symfony2中的登录页面并阻止浏览器打开缓存页面？

Question

Once I logged out from my Symfony2 app I can press back button and I can still see password protected pages pulled from browser cache.

I have simple:

$session = $request->getSession();
$session->clear();

in my logoutAction .

Any idea how to do prevent this?

Answer 1

No cache header with annotation

This is an answer I found and used for one of my own projects. However it can be tailored to match against specific routes, in which case you could create a service that informs the event listener when and when not to do this.

Answer 2

An easy way to implement headers to prevent caching for your restricted routes is provided by LiipCacheControlBundle .

You can get a an idea of how it works by looking at this configuration example .

A list of headers that can be used to prevent caching:

Cache-Control: ( HTTP > 1.1 )

• no-cache
• must-revalidate
• no-store
• max-age=0

Pragma ( the HTTP 1.0 version of Cache-Control )

• no-cache

Answer 3

If you are using Symfony 2.5.* could be a security flaw that comes from the browser cache. The general (but not complete) solution is to send "Expire" headers that the browser may (or may not) pay attention to when you use the back-button behaviour. Here's the Symfony docs for HTTP Cache headers