I am using FileMaker authentication. However when I use the following syntax it does not log the user out.

In both Safari and IE (mac) the user can click on the back button or the login button and automatically be logged back in. I thought it is suppose to end the session immediately. I am sure I am doing something wrong.

Tim Brown

The session is indeed invalidated, but only server-side. The problem, however is, that the browsers cache and keep also in their history the visited pages.

The only secure way is to tell the users to quit their browser software.

Less secure ways are:

- when the next action is performed on the page that was visited with the back button of the browser, check if the session is still valid (e.g. check if the session cookie still exists). If not, cancel the action and logout the user again.

- overwrite the history of last visited page with the JavaScript location.replace() method