need help with logout (logout not perfect)

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • crescent_au@yahoo.com

    need help with logout (logout not perfect)

    Hi all,

    I've written a login/logout code. It does what it's supposed to do but
    the problem is when I logout and press browser's back button (in
    Firefox), I get to the last login page. In IE, when I press back
    button, I get to the page that says "Page has Expired" but Firefox does
    not do this.

    I think it's something to do with sessions not properly unset or
    something like that but I haven't been able to figure it out. I am
    attaching my codes and database structure below. If you need more info,
    please email me. I really want this to be fixed asap. I've played with
    this long enough. Thanks!

    Login class:
    -----------------

    class Login {
    //var $loginflag;
    //var $db_connect;

    function Login() {
    //$this ->db_connect = $db_connect;

    if (!isset($_SESSI ON['uid']) || $_SESSION['uid'] == 0) {
    $this->set_session_de faults();
    echo "inside login class<br />";
    }
    }

    function check_login($us ername, $password) {
    global $db;
    $link=$db->connectDB();

    if ($_SESSION['logged']) {
    $this->check_session( );
    echo "logged...< br />";
    return true;
    } else {
    $username = mysql_escape_st ring($username) ;
    $query = "SELECT * FROM users WHERE username = '$username' AND
    AES_DECRYPT(pas sword, 'dreamfilmslogi n438ismbtsx') = '$password'";
    $result = mysql_query($qu ery, $link) or die("Could not select");

    if (mysql_num_rows ($result)) {
    $this->set_session($u sername = mysql_fetch_ass oc($result), true);
    return $username['username'];
    } else {
    $this->failed = true;
    session_destroy ();
    return false;
    }
    }
    }

    function check_session() {
    global $db;
    $link=$db->connectDB();

    $username = mysql_escape_st ring($_SESSION['username']);
    $token = mysql_escape_st ring($_SESSION['token']);
    $session = mysql_escape_st ring(session_id ());
    $ip = mysql_escape_st ring($_SERVER['REMOTE_ADDR']);

    $query = "SELECT * FROM users WHERE username='{$use rname}' AND
    token='{$token} ' AND session='{$sess ion}' AND ip='{$ip}'";
    $result = mysql_query($qu ery, $link) or die("Could not select");
    echo "check session:<br />";
    print_r($result );
    echo "<br />";
    if ($result != false) {
    } else {
    $this->logout();
    }
    }

    function set_session_def aults() {
    //session_start() ;
    ////session_registe r("logged", "uid", "username") ;
    $_SESSION['logged'] = false;
    $_SESSION['uid'] = 0;
    $_SESSION['username'] = '';
    }

    function set_session($re sult,$init = true) {
    global $db;
    $link=$db->connectDB();

    if ($init) {
    //session_start() ;
    $session = mysql_escape_st ring(session_id ());
    $ip = mysql_escape_st ring($_SERVER['REMOTE_ADDR']);
    $result['token'] = $this->token(); // generate a new token
    $query = "UPDATE users SET session='{$sess ion}',
    token='{$result['token']}', ip='{$ip}' WHERE uid='{$result['uid']}'";
    mysql_query($qu ery, $link) or die("Could not select");
    $_SESSION['logged'] = true;
    $_SESSION['uid'] = $result['uid'];
    $_SESSION['username'] = $result['username'];
    echo "set session:<br />";
    print_r($result );
    echo "<br />";
    echo "session: ".$session. "<br />";
    echo "ip: ".$ip."<br />";
    }
    }

    function token() {
    // generate a random token
    for($i=1;$i<33; $i++) {
    $seed .= chr(rand(0,255) );
    }
    return md5($seed);
    }

    function logout() {
    global $db;
    $link=$db->connectDB();

    $query = "UPDATE users SET session='', token='', ip='' WHERE
    uid='{$_SESSION['uid']}'";
    mysql_query($qu ery, $link) or die("Could not select");
    mysql_close($li nk);


    unset($_SESSION['username']);
    unset($_SESSION['logged']);
    unset($_SESSION['uid']);
    // kill session variables
    $_SESSION = array(); // reset session array
    session_destroy ();



    /**$this->set_session_de faults();
    session_destroy ();*****/

    echo "logged out...<br />";
    return true;
    }
    } // end class Login



    DBAccess class
    -------------------------
    class DBAccess {
    var $_login;

    // Constructor
    function DBAccess() {
    $this -_login = array();
    $this -_login['db_loginid'] = "testuser";
    $this -_login['db_password'] = "";
    $this -_login['hostname'] = "localhost" ;
    $this -_login['db_name'] = "dblogin";
    }

    function connectDB() {
    if (!($link = @mysql_connect( $this->_login['hostname'],
    $this->_login['db_loginid'], $this->_login['db_password']))) {
    echo "<strong>Co uld not connect:&nbsp;</strong>".mysql_ error()."<br
    /><hr size='1' /><br />";
    } else if (!@mysql_select _db($this->_login['db_name'],$link)) {
    echo "Could not select database";
    }
    if ($link) {
    return $link;
    }
    } // end connectDB()
    } // end class DB_Access


    database structure
    ----------------------------
    CREATE TABLE `users` (
    `uid` int(11) NOT NULL auto_increment,
    `username` varchar(20) NOT NULL default '',
    `password` varchar(50) NOT NULL default '',
    `token` varchar(100) NOT NULL default '',
    `session` varchar(100) NOT NULL default '',
    `ip` varchar(20) NOT NULL default '',
    PRIMARY KEY (`uid`),
    UNIQUE KEY `username` (`username`)
    ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT= 2 ;

  • Koncept

    #2
    Re: need help with logout (logout not perfect)

    In article <1162207549.606 471.131080@i42g 2000cwa.googleg roups.com>,
    <crescent_au@ya hoo.comwrote:
    Hi all,
    >
    I've written a login/logout code. It does what it's supposed to do but
    the problem is when I logout and press browser's back button (in
    Firefox), I get to the last login page. In IE, when I press back
    button, I get to the page that says "Page has Expired" but Firefox does
    not do this.
    >
    I think it's something to do with sessions not properly unset or
    something like that but I haven't been able to figure it out. I am
    attaching my codes and database structure below. If you need more info,
    please email me. I really want this to be fixed asap. I've played with
    this long enough. Thanks!
    >
    Just curious what happens if you add these headers to the previous
    pages?

    ( code from docs )

    <?php
    header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
    header("Expires : Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
    ?>

    And this for the destruction of the session:

    <?php
    $_SESSION = array();

    // Note: This will destroy the session, and not just the session data!
    if ( isset( $_COOKIE[session_name()] ) )
    setcookie( session_name(), '', time() - 42000, '/' );

    // Finally, destroy the session.
    session_destroy ();
    ?>

    --
    Koncept <<
    "The snake that cannot shed its skin perishes. So do the spirits who are
    prevented from changing their opinions; they cease to be a spirit." -Nietzsche

    Comment

    • crescent_au@yahoo.com

      #3
      Re: need help with logout (logout not perfect)

      >Koncept wrote:
      Just curious what happens if you add these headers to the previous
      pages?
      >
      ( code from docs )
      >
      <?php
      header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
      header("Expires : Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
      ?>
      >
      And this for the destruction of the session:
      >
      <?php
      $_SESSION = array();
      >
      // Note: This will destroy the session, and not just the session data!
      if ( isset( $_COOKIE[session_name()] ) )
      setcookie( session_name(), '', time() - 42000, '/' );
      >
      // Finally, destroy the session.
      session_destroy ();
      ?>
      >
      No, still the same. I don't have any cookies set. I've only used
      sessions in my code but anyway I tried all the above you have suggested
      but there is no difference in the outcome. I hope someone can help me
      with this.

      If you want the codes, I can even email you the codes. Just let me know
      by email. I really need to get this fixed.

      Thanks

      Comment

      • Jerry Stuckle

        #4
        Re: need help with logout (logout not perfect)

        crescent_au@yah oo.com wrote:
        Hi all,
        >
        I've written a login/logout code. It does what it's supposed to do but
        the problem is when I logout and press browser's back button (in
        Firefox), I get to the last login page. In IE, when I press back
        button, I get to the page that says "Page has Expired" but Firefox does
        not do this.
        >
        I think it's something to do with sessions not properly unset or
        something like that but I haven't been able to figure it out. I am
        attaching my codes and database structure below. If you need more info,
        please email me. I really want this to be fixed asap. I've played with
        this long enough. Thanks!
        >
        No, Firefox has most probably pulled this from its cache. Disable the
        cache (set to 0) and your problem will go away.

        --
        =============== ===
        Remove the "x" from my email address
        Jerry Stuckle
        JDS Computer Training Corp.
        jstucklex@attgl obal.net
        =============== ===

        Comment

        • Jerry Stuckle

          #5
          Re: need help with logout (logout not perfect)

          Koncept wrote:
          In article <1162207549.606 471.131080@i42g 2000cwa.googleg roups.com>,
          <crescent_au@ya hoo.comwrote:
          >
          >
          >>Hi all,
          >>
          >>I've written a login/logout code. It does what it's supposed to do but
          >>the problem is when I logout and press browser's back button (in
          >>Firefox), I get to the last login page. In IE, when I press back
          >>button, I get to the page that says "Page has Expired" but Firefox does
          >>not do this.
          >>
          >>I think it's something to do with sessions not properly unset or
          >>something like that but I haven't been able to figure it out. I am
          >>attaching my codes and database structure below. If you need more info,
          >>please email me. I really want this to be fixed asap. I've played with
          >>this long enough. Thanks!
          >>
          >
          >
          Just curious what happens if you add these headers to the previous
          pages?
          >
          ( code from docs )
          >
          <?php
          header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
          header("Expires : Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
          ?>
          >
          And this for the destruction of the session:
          >
          <?php
          $_SESSION = array();
          >
          // Note: This will destroy the session, and not just the session data!
          if ( isset( $_COOKIE[session_name()] ) )
          setcookie( session_name(), '', time() - 42000, '/' );
          >
          This line will never do anything. The session_name is the value of the
          cookie, not the name. The cookie name is set in the php.ini file
          (default: PHPSESSID).
          // Finally, destroy the session.
          session_destroy ();
          ?>
          >

          --
          =============== ===
          Remove the "x" from my email address
          Jerry Stuckle
          JDS Computer Training Corp.
          jstucklex@attgl obal.net
          =============== ===

          Comment

          • Koncept

            #6
            Re: need help with logout (logout not perfect)

            In article <nbGdnTTol9Gf3d rYnZ2dnUVZ_tOdn Z2d@comcast.com >, Jerry
            Stuckle <jstucklex@attg lobal.netwrote:
            // Note: This will destroy the session, and not just the session data!
            if ( isset( $_COOKIE[session_name()] ) )
            setcookie( session_name(), '', time() - 42000, '/' );
            >
            This line will never do anything. The session_name is the value of the
            cookie, not the name.
            That's incorrect. session_name() will return the key (*PHPSESSID* )
            which is then used as a key in the $_COOKIE superglobal to point to the
            current session id.



            You will notice that the code I provided you is directly from the PHP
            docs and it is *not* incorrect.

            As you can see from the example below, each time I start a new browser
            session, I can, in fact, echo out what you suggest to be superfluous.
            Perhaps the answer to your problem lies in this simple oversight unless
            you have altered the value of "session.use_co okies" in your ini file.

            <?php
            session_start() ;

            if(isset($_COOK IE[session_name()])){
            echo $_COOKIE[session_name()];
            }
            // 72728376dfdd7f3 de60f75111ace5a 6e (first session - browser one)
            // 1ce309fbb3bbdd0 d34ed2b73be8cbe 5b (first session - browser two)
            ?>

            --
            Koncept <<
            "The snake that cannot shed its skin perishes. So do the spirits who are
            prevented from changing their opinions; they cease to be a spirit." -Nietzsche

            Comment

            • Jerry Stuckle

              #7
              Re: need help with logout (logout not perfect)

              Koncept wrote:
              In article <nbGdnTTol9Gf3d rYnZ2dnUVZ_tOdn Z2d@comcast.com >, Jerry
              Stuckle <jstucklex@attg lobal.netwrote:
              >
              >
              >>>// Note: This will destroy the session, and not just the session data!
              >>>if ( isset( $_COOKIE[session_name()] ) )
              >> setcookie( session_name(), '', time() - 42000, '/' );
              >>>
              >>
              >>This line will never do anything. The session_name is the value of the
              >>cookie, not the name.
              >
              >
              That's incorrect. session_name() will return the key (*PHPSESSID* )
              which is then used as a key in the $_COOKIE superglobal to point to the
              current session id.
              >

              >
              You will notice that the code I provided you is directly from the PHP
              docs and it is *not* incorrect.
              >
              As you can see from the example below, each time I start a new browser
              session, I can, in fact, echo out what you suggest to be superfluous.
              Perhaps the answer to your problem lies in this simple oversight unless
              you have altered the value of "session.use_co okies" in your ini file.
              >
              <?php
              session_start() ;
              >
              if(isset($_COOK IE[session_name()])){
              echo $_COOKIE[session_name()];
              }
              // 72728376dfdd7f3 de60f75111ace5a 6e (first session - browser one)
              // 1ce309fbb3bbdd0 d34ed2b73be8cbe 5b (first session - browser two)
              ?>
              >
              My mistake. But I'm not the one having the problem. And this code
              doesn't solve his real problem - which is page caching in Firefox.

              --
              =============== ===
              Remove the "x" from my email address
              Jerry Stuckle
              JDS Computer Training Corp.
              jstucklex@attgl obal.net
              =============== ===

              Comment

              • Steve

                #8
                Re: need help with logout (logout not perfect)

                | Koncept <<
                | "The snake that cannot shed its skin perishes. So do the spirits who are
                | prevented from changing their opinions; they cease to be a
                pirit." -Nietzsche

                so, does this mean the absense of an opinion or the inability to change an
                opinion make an apple cease to be an apple?


                Comment

                • Koncept

                  #9
                  Re: need help with logout (logout not perfect)

                  In article <11N1h.836$r%.6 3@newsfe06.lga> , Steve <no.one@example .com>
                  wrote:
                  so, does this mean the absense of an opinion or the inability to change an
                  opinion make an apple cease to be an apple?
                  *Assertion* *1*: The absence of opinion makes an apple cease to be an
                  apple.

                  *Assertion* *2*: The inability to change opinion makes an apple cease
                  to be an apple.

                  *Answer*
                  If the apple were capable of formulating opinion in the first place,
                  then to lose such a noble quality would certainly make the apple less
                  distinguished amongst its peers; however, considering that the apple
                  never had such talent, it will simply continue to maintain its status
                  as an object neither capable of opinion, nor of spiritual nature.

                  Truth be told, I'd still eat it regardless!

                  Remember ... An • a day keeps the doctor away.

                  --
                  Koncept <<
                  "The snake that cannot shed its skin perishes. So do the spirits who are
                  prevented from changing their opinions; they cease to be a spirit." -Nietzsche

                  Comment

                  • Koncept

                    #10
                    Re: need help with logout (logout not perfect)

                    In article <FbSdnallbvRjF9 rYnZ2dnUVZ_redn Z2d@comcast.com >, Jerry
                    Stuckle <jstucklex@attg lobal.netwrote:
                    My mistake. But I'm not the one having the problem.
                    And it was my mistake (realized after posting the reply ) that you were
                    the original author. Sorry 'bout that.

                    --
                    Koncept <<
                    "The snake that cannot shed its skin perishes. So do the spirits who are
                    prevented from changing their opinions; they cease to be a spirit." -Nietzsche

                    Comment

                    • crescent_au@yahoo.com

                      #11
                      Re: need help with logout (logout not perfect)

                      So what's the solution??

                      I think disabling the cache in FF is not the real solution. Can't it be
                      done from the code itself? I've looked at some other login codes used
                      in opensource applications. They are basically using functions like
                      unset("session_ name"). I am doing the same but for me it's not working.
                      I have no idea why it's not working for me.


                      Koncept wrote:
                      In article <FbSdnallbvRjF9 rYnZ2dnUVZ_redn Z2d@comcast.com >, Jerry
                      Stuckle <jstucklex@attg lobal.netwrote:
                      >
                      My mistake. But I'm not the one having the problem.
                      >
                      And it was my mistake (realized after posting the reply ) that you were
                      the original author. Sorry 'bout that.
                      >
                      --
                      Koncept <<
                      "The snake that cannot shed its skin perishes. So do the spirits who are
                      prevented from changing their opinions; they cease to be a spirit." -Nietzsche

                      Comment

                      • Jerry Stuckle

                        #12
                        Re: need help with logout (logout not perfect)

                        crescent_au@yah oo.com wrote:
                        So what's the solution??
                        >
                        I think disabling the cache in FF is not the real solution. Can't it be
                        done from the code itself? I've looked at some other login codes used
                        in opensource applications. They are basically using functions like
                        unset("session_ name"). I am doing the same but for me it's not working.
                        I have no idea why it's not working for me.
                        >
                        >
                        Koncept wrote:
                        >
                        >>In article <FbSdnallbvRjF9 rYnZ2dnUVZ_redn Z2d@comcast.com >, Jerry
                        >>Stuckle <jstucklex@attg lobal.netwrote:
                        >>
                        >>
                        >>>My mistake. But I'm not the one having the problem.
                        >>
                        >>And it was my mistake (realized after posting the reply ) that you were
                        >>the original author. Sorry 'bout that.
                        >>
                        >>--
                        >>Koncept <<
                        >>"The snake that cannot shed its skin perishes. So do the spirits who are
                        >>prevented from changing their opinions; they cease to be a spirit." -Nietzsche
                        >
                        >
                        Nope, because Firefox is never going to your site. It's just serving
                        the page up locally.

                        You can set the page to expire immediately - but even that is only a
                        recommendation to the browser - not a requirement.

                        The only solution is to close the browser after logging off.

                        --
                        =============== ===
                        Remove the "x" from my email address
                        Jerry Stuckle
                        JDS Computer Training Corp.
                        jstucklex@attgl obal.net
                        =============== ===

                        Comment

                        • crescent_au@yahoo.com

                          #13
                          Re: need help with logout (logout not perfect)

                          >
                          Nope, because Firefox is never going to your site. It's just serving
                          the page up locally.
                          >
                          You can set the page to expire immediately - but even that is only a
                          recommendation to the browser - not a requirement.
                          >
                          The only solution is to close the browser after logging off.
                          >
                          So doesn't that mean my website is insecure? People can just go back
                          and access the pages inspite of being logged out. But how come lot of
                          other websites I have accessed are loggout out properly? That's why I
                          thought it's something to do with my code.

                          Comment

                          • Steve

                            #14
                            Re: need help with logout (logout not perfect)

                            | "The snake that cannot shed its skin perishes. So do the spirits who are
                            | prevented from changing their opinions; they cease to be a
                            pirit." -Nietzsche

                            | *Answer*
                            | If the apple were capable of formulating opinion in the first place,
                            | then to lose such a noble quality would certainly make the apple less
                            | distinguished amongst its peers;

                            in what ways would it be less distinguished? doesn't this presuppose as a
                            foregone conclusion that to *be* an apple, it must emote opinion?

                            | however, considering that the apple
                            | never had such talent, it will simply continue to maintain its status
                            | as an object neither capable of opinion, nor of spiritual nature.

                            others may take your dismissal of the possible spirituality of nature - even
                            that of an apple - as a terribly imprompto assumption. either way, being
                            prevented from changing an opinion does not change the nature of the apple
                            itself were it able to formulate them. so, a snake may very well die if it
                            fails to shed its skin; it does not necessitate logically that a spirit not
                            able to, or prevented from, doing something/anything part of its nature
                            somehow removes the natural component altogether. the spirit remains a
                            spirit...as the apple is still an apple.

                            perhaps it is the fault of the translator rather than an illogical oversight
                            of neitzsche. where neitzsche consistent in his analogy and compared the
                            *death* of the spirit to the *perishing* of a snake, it would not be
                            illogical as it would be comparing two kinds of death - the first, literal;
                            the second, a deminished quality of life. as it is, he is comparing the
                            literal death of a snake to the alteration of the nature of a spirit
                            (assumably who MUST emote opinion) into some other form of being.

                            simply put...if a human is defined as such because of his ability to see,
                            can i take his eyes and make him non-human. or, if he must be social yet i
                            exile him to a desserted island...is he not still human? to be human is
                            merely to be engineered as such. neitzsche has engineered a spirit that can
                            hold opinion, but has sadly killed it off when no such requirement was
                            warranted.

                            | Truth be told, I'd still eat it regardless!

                            me too ;^)


                            Comment

                            • Michael Fesser

                              #15
                              Re: need help with logout (logout not perfect)

                              ..oO(crescent_a u@yahoo.com)
                              >So doesn't that mean my website is insecure?
                              No.
                              >People can just go back
                              >and access the pages inspite of being logged out.
                              Of course they can go back in the browser history, but if they're logged
                              out they shouldn't be able to do anything on that expired page anymore.
                              >But how come lot of
                              >other websites I have accessed are loggout out properly?
                              It's a common "problem", but usually nothing to worry about. When I log
                              into my webmail account to clean up my spam folder for example and then
                              log off, I can still go back in the browser's history. But if I then
                              click a link and try to access a protected page I get the message that
                              I'm no longer logged in.

                              Micha

                              Comment

                              Working...