Re: PUT login arg caching: I've got to be missing something.

On Thu, 2005-09-15 at 17:58 -0500, Guyren G Howe wrote:
> Let me try again: I *have* to be missing something.
> 
> I have our users log in, passing the userid and password in PUT args.
> 
> They then get where they were trying to go, and every page has a  
> logout link on it, which I hand to liveUser in the validate script I  
> include from every page.
> 
> So, if the user logs in, then logs out, then uses the history menu to  
> go back to the page immediately after the one they saw after they  
> logged in... They just silently log in again.
> 
> This can't be right. All these major websites using LiveUser can't  
> tolerate this behavior.
> 
> It's clear how to fix it myself, but I can't believe there isn't  
> something already in LiveUser to deal with this.
> 
> What am I missing?

With out having read the whole discussion I'm going to attempt answering
this a bit to what I think.

Here's the thing, LiveUser does not do anything with $_GET, $_POST,
$_REQUEST or what ever, it's you (the user) pass to LiveUser, so the
handle/password could in fact be some hard coded value, LiveUser
wouldn't make any difference ... So I'm not sure how we should be able
to handle this in LiveUser at any rate, so it's rather something you
should be handling rather then we doing some half cooked way in
LiveUser.

In addition, if you go back to a page that has already done a PUT
request then it will be issued again, that's just way browsers work,
again LiveUser can't prevent this :)

Those things are as is to my best understanding, Lukas might correct me
if I'm talking out of my ars ;)

- Helgi