note 14512 deleted from function.header by jimw
| From: | jimw@php.net | Date: | Wed, 31 Oct 2001 22:07:57 +0000 |
| Subject: | note 14512 deleted from function.header by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-19804@lists.php.net to get a copy of this message | ||
Written above:
"But after logout you only need to go back to the first page of the 'members' area
and press F5 and voila: You're loged in again without the need of retyping the password!"
To prevent this, you can add timestamp to login page:
<input type="hidden" name="logtime" value=<?php echo time(); ?> >
and on the page where you check out the correctness of username and password you should also check
the timestamp
if ( time() - $logtime > 15 ) ...
if over 15 second has elapsed the page is propably refreshed (F5!)