if you log out you can click the back button and see the previous logged in page

[hahn-kev]

Describe the bug When you log out your local cache should be cleared and clicking back should not be able to take you to a page with sensitive data

To Reproduce

1. login as admin
2. be on the admin dashboard (page probably doesn't matter)
3. log out
4. from the login page, click the browser back button
5. you can see the admin dashboard again even though you should be logged out

Expected behavior trying to go back should just redirect you back to the login page. Additionally we should figure out where the data is coming from that is being displayed when you go back as the cache should have also been cleared.

[myieye]

The browser is simply pulling things out of its cache.

• One page was always SSRed. For admins that's often the admin page.
• All the load-function request responses are inlined in the SSRed page.
• So, as long as no requests were only done client-side (e.g. query projectChangesets on the project page only happens client-side), no requests will hit either SvelteKit or the API, so we won't detect that the user isn't authenticated anymore.
• Even on the project page, the user can briefly see project info before we chase them away.

We clear the GQL cache and invalidate SvelteKit stuff (by simply doing a full page load), but we never clear the browser cache, because we can't.

So, I think the only bullet-proof way to handle this is to disable the browser cache (for relevant requests) e.g.:

response.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, private');
response.headers.set('Pragma', 'no-cache');
response.headers.set('Expires', '0');

Any other solution will have holes, but they might still be worth considering E.g.:

1. On logout, we could explicitly set the cookie in the browser to something (e.g. "INVALID") and check for that value on authenticated pages, redirecting back to the login if we detect it.
2. We could play with browser history, so that the back button doesn't work (e.g. insert an item that always redirects to the login) but that's sort of pointless, because the back button isn't the only way to navigate browser history.

[hahn-kev]

I wonder if we can just store something in memory and when they navigate back we should receive a navigate event which we can react to. But maybe that's over designing it.

[myieye]

Actually, I just found the right header to tell the browser to clear its cache: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data#browser_compatibility

I'm pretty sure it's exactly what we want