1

I have a login area on a site which basically just shows a users profile fields. I'm using the {{ logoutUrl }} tag for my logout link and when the user goes to the logoutUrl they're redirected to the homepage however if they visit the profile page URL again, they can still see the content (as if they're logged in) until they do a hard refresh (CMD + SHIFT + R). This seems to be the case in three different browsers. I have tried both of the following to determine if the user is logged in:

{% if craft.session.isLoggedIn %}

And

{% if currentUser %}

Both seem to be effective at showing the content once they login but it's as if the session is being cached or something as these tests are still true after logging out.

Note this happens when I either click a link to the profile URL or manually type it in the address bar. I am not clicking back in the browser.

Also I have also set a custom path with "logoutPath" in the config but this doesn't seem to be affecting the issue I'm having.

Any help would be greatly appreciated!

Improve this question
9
  • Maybe some browser or PHP opcache caching going on? Open your browser's inspector and click on the Resources tab and click on cookies. When you're authenticated, you'll have a cookie with a name that is random letters and numbers (like 4190d8c6874f8615f88325f5b285fc40). Does that go away when you click logout?
    – Brad Bell
    Aug 19, 2015 at 0:40
  • Two really simple things to check. 1. Is the logoutUrl correct? 2. Is the content they're looking at actually behind a {{ requireLogin }} tag?
    – darylknight
    Aug 22, 2015 at 9:30
  • @BradBell the cookie seems to stay there, both locally (basic mamp setup) and on my server. When I log out and even when I do a hard reload the cookie "CraftSessionId" remains.
    – Andy
    Aug 24, 2015 at 19:44
  • @Andy It's not the CraftSessionId cookie (that's for PHP sessions), it's the one with the name that is random letters/numbers.
    – Brad Bell
    Aug 24, 2015 at 19:55
  • @BradBell sorry I misread your comment, I've just checked an the cookie seems to still be set once logged out. Same again with the reload etc. :(
    – Andy
    Aug 24, 2015 at 20:08

1 Answer 1

Reset to default
1

Turns out this was caused by me setting a "Cache-Control: max-age" header which I was testing with Google Page Speed and I forgot to move it. This meant the browser was caching everything including the session cookie.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.