RE: Browser refresh sends username/password after log out -- URGENT

The fact that a refresh on the 7th page is sending the form vars from the login sounds to me like something else is happening:

1. Refresh on 7th page
2. App determins that user is not logged in and redirects to login page
3. Browser tries to be smart, and on the redirect sends its cached form vars for the login page

Do you see any redirect headers in the net traffic? Unless you are writing the login form fields to every page, I do not see how/why the browser would resend those specific field vars...why would it not send all field vars from the last 6 pages then? My guess is a redirect, and a browser that is trying to be too smart.

Hth,
-tim

-----Original Message-----
From: Krk [mailto:krk41@yahoo.com]
Sent: Tuesday, August 05, 2003 11:59 PM
To: Ingo Struck
Cc: webappsec@securityfocus.com
Subject: RE: Browser refresh sends username/password after log out -- URGENT Hi Ingo ...
  thanks for the reply.

More clearly the issue here is also that:

1.) We login using username/password
2.) Suppose we have browsed 7 pages after log in and then we say logout and we get logout message so after logging in this is the 8th page.

3.) Now after this we just do 1 back, so effectively we should bein the 7th page that we had browsed.

 4.) Now we do a refresh( this is again on the 7th page and not on the login page) and the same request that we had sent in the login form is being resent. This is what i am wondering that how come the refresh sends the form fields that were entered in the Login Form and not the "Logout" request which
we had sent from the 7th page.
5)hope I am making the question clear.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

thnaks

Krk
--- Ingo Struck <ingo@ingostruck.de> wrote:
> Hi...

     EVERY NIGHT YOU HAVE SOME TROUBLE,
     IF YOU WORRY YOU MAKE IT DOUBLE,
     SO DON'T WORRY BE HAPPY NOW...."

__________________________________