|
session expires when you close the browser, yeah.. but if not the session stay there... The problem, I believe, has exactly to do with the ability of any modern browser to maintain a cached history of previous pages. When one logs out, the session cookie may not be valid anymore, however, all pages that were received during the session from which the user logged out are still in the browser cache. This means that unless the user takes care of closing the browser, a security breach may occur if someone else has access to the open browser: he or she would only have to click the browser back button. He wouldn't be able to request anything without getting the login screen, but he could have access to any reports that the previous session may have requested, eventually with sensitive information.
|