Why does logging out of a website not completely destroy the session, allowing re-entry via the browser history?

When a user logs out of a website, the session on the server is typically destroyed, but the browser may still store the session data in its history. This can allow a user to navigate back to the previous page and re-enter the website without logging in again. To prevent this, you can use additional measures such as setting cache-control headers or implementing a double-submit cookie technique to ensure that the session is completely destroyed. 

// Add this code to the logout page to ensure session is completely destroyed
session_start();

// Unset all session variables
$_SESSION = array();

// Destroy the session
session_destroy();

// Ensure that the session cookie is deleted
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

// Prevent caching of the page
header("Cache-Control: no-cache, no-store, must-revalidate");
header("Pragma: no-cache");
header("Expires: 0");

// Redirect to login page
header("Location: login.php");
exit();

Keywords

PHP session browser history logout security

Related Questions