I have upgraded today from 5.2 to 5.3 and then 6.0 Beta 3
All versions have the same behavior.
My PC is using the latest version of Firefox and Windows XP
If I log onto my site http://phtumbler.com with a normal registered user, look at two or three pages, and then logout - all works as expected - home page returns to guest, and offers me a new log in.
But if I browse a few pages, and then go to the home page, using the breadcrumb "home" option - when I log out the client flickers - but does appears as if it has remained logged in.
But it has not - attempting to log out again, gives a "not authorized to access this page"
Going to one of the other pages, behaves as if I were a guest (I have some right column blocks restricted to guest (others for registered) - the pages offer the guest selection.
The only way to clear this conflict, is to log on by http/phtumbler.com/user - forcing a new log in - and doing an administrative update.
Doping the update appears to reset whatever is locked up, and so long as I do not return home prior to doing the log off it will correct complete the log out.
I have tested using IE but it does not do this - the issue is only with Firefox
I have also tested on various other public sites, including this one, but I cannot duplicate the issue on these sites.
I wonder what combination I have created on the server to manifest this condition.
I have tried deleting cookies, in fact re-installed firefox completely, to see if this was the issue - but no change.
I hope this may be of use to you ....
Alex
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | change profile.jpg | 91.55 KB | ricabrantes |
| #3 | logout_fails-196224-1.patch | 771 bytes | floretan |
Comments
Comment #1
adTumbler commentedI have tested further having seen an open bug on the logout cache.
I have disabled caching and the problem has been resolved.
I suspect the issue is one of what gets cached when the user returns to the home page via the system (breadcrumb) return to home, and the logs out from that page.
Again - I hope this assists in some way
Thanks for all your excellent work people
Alex
Comment #2
ricabrantes commentedStill active in D7.x-dev..
Reproduce:
1 - Login
2 - Go to edit account
3 - Click in Logout
4 - Go back page
Only with Firefox
Comment #3
floretan commentedIn order to make sure that the browser makes a new HTTP request when using the "back" button, the headers in drupal_page_header() need to be modified. Here's a patch that adds the required headers to fix the specific case mentioned above, showing that it can be done. However, the current headers have a good reason to be the way they are, and we need to take a good look at the consequences of modifying the headers. In order to preserve performance, it might be needed to generate different headers depending on the context (logged-in state, etc).
Comment #4
ricabrantes commentedIf i have other profiles, can be changed even after the logout...
Comment #5
catchI would won't fix anything which forces a reload on the back button for every Drupal page request. This was an issue right up to 5.x and it resulted in lost form data for a bunch of users alongside the performance implications.
Comment #6
floretan commentedBefore writing this patch I took a look at the behavior of other php applications/sites, and it turns out that Facebook does force a reload on the back button. It's not necessarily a good example of good practices, but it's nonetheless one of the largest php-driven websites.
I definitely agree that in most cases we don't want to force a reload for the reasons catch mentioned, but it's a behavior that some sites might want to enable anyway, without having to modify core Drupal code (or if they need to, now there's a patch for it).
Comment #7
floretan commented