Cached information shown after logout

[markseuffert]

There's a problem when using the edit extension, thanks Santhosh Tuppad for testing and reporting.

Log in with your user account, browse some pages, logout again and click on the back button of the web browser. Now you can see cached information, possibly private pages and settings. This shouldn't happen. Instead the web browser should show the login screen, if you're not logged in.

[BsNoSi]

Uups. I always thought this is an effect of my very personal settings…

I checked the Cookies set by YELLOW and explored an invalid expiration date (19.1.1970) . As far as I can see, they are deleted on log of but survive if I simply close the tab. Accessing …/edit/ of this website again, it is "open" (in this browser) without asking for log in. It is possible to update the site, modify user settings without any restrictions.

I am not sure, if You have to log out for security reasons! advice is enough. Maybe the behavior should change and …/edit/ should only be available with a valid expiration setting. This can be set to 30 minutes in advance and is renewed for the next 30 minutes with any action (→ edit, save,…) when I am logged in. No action within 30 minutes leads to the requirement to log in again.
This is (as far as I know) the typical behavior of banking weg pages or i.e. plesk hosting.

[BsNoSi]

• Does is delete the cookies?
• Is it updated by actions (edit, save,…)?
• Does is close a session of a simply closed tab?
• Does it heal the described effect(s)?

If all four »yes«: Why isn't it set by default?
(To be precise: Is it set by default in a new installation and has to be added in updated ones?)

[markseuffert]

Are your comments related to this bug report?

[BsNoSi]

I think so, if they possibly solve the problem.

[markseuffert]

Thanks for your help, as far as I can see this problem is caused by caching. When you're logged in the browser should not store pages in the regular cache and you also don't want them in the back/forward cache (BFCache). For the first part I have a bugfix, for the second part I haven't found a way to disable the BFCache of Safari.

[markseuffert]

Should be working now.