1

I have a login area on a site which basically just shows a users profile fields. I'm using the {{ logoutUrl }} tag for my logout link and when the user goes to the logoutUrl they're redirected to the homepage however if they visit the profile page URL again, they can still see the content (as if they're logged in) until they do a hard refresh (CMD + SHIFT + R). This seems to be the case in three different browsers. I have tried both of the following to determine if the user is logged in:

{% if craft.session.isLoggedIn %}

And

{% if currentUser %}

Both seem to be effective at showing the content once they login but it's as if the session is being cached or something as these tests are still true after logging out.

Note this happens when I either click a link to the profile URL or manually type it in the address bar. I am not clicking back in the browser.

Also I have also set a custom path with "logoutPath" in the config but this doesn't seem to be affecting the issue I'm having.

Any help would be greatly appreciated!

Improve this question
9
  • Maybe some browser or PHP opcache caching going on? Open your browser's inspector and click on the Resources tab and click on cookies. When you're authenticated, you'll have a cookie with a name that is random letters and numbers (like 4190d8c6874f8615f88325f5b285fc40). Does that go away when you click logout? – Brad Bell Aug 19 '15 at 0:40
  • Two really simple things to check. 1. Is the logoutUrl correct? 2. Is the content they're looking at actually behind a {{ requireLogin }} tag? – darylknight Aug 22 '15 at 9:30
  • @BradBell the cookie seems to stay there, both locally (basic mamp setup) and on my server. When I log out and even when I do a hard reload the cookie "CraftSessionId" remains. – Andy Aug 24 '15 at 19:44
  • @Andy It's not the CraftSessionId cookie (that's for PHP sessions), it's the one with the name that is random letters/numbers. – Brad Bell Aug 24 '15 at 19:55
  • @BradBell sorry I misread your comment, I've just checked an the cookie seems to still be set once logged out. Same again with the reload etc. :( – Andy Aug 24 '15 at 20:08
1

Turns out this was caused by me setting a "Cache-Control: max-age" header which I was testing with Google Page Speed and I forgot to move it. This meant the browser was caching everything including the session cookie.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.