Unauthorized access with "←" button

[basuabhirup]

Some of our fellow students have found that even after logging out from the app - the cookies continue to remain saved inside the browser, making the secrets page accessible with the ← / Back / Previous Page button of the browser.

What we need is to control the Cache and prevent them from getting stored inside the user's browser. I have a suggestion to modify the handler function of GET requests made on the /secrets route to fix this issue:

app.get('/secrets', (req, res) => {
  res.set('Cache-Control', 'no-store');
  if(req.isAuthenticated()) {
    res.render('secrets');
  } else {
    res.redirect('/login');
  }
})

Know more about cache control.

[sundaram2021]

I didn't get the Issue

[Crazyhead90]

Simply adding a isAuthenticated check will also solve the direct access to the secrets

app.get("/secrets", function(req, res){
  if(req.isAuthenticated()) {
    User.find({"secret": {$ne: null}}, function(err, foundUsers){
      res.render('secrets', {usersWithSecrets: foundUsers});
    })
  } else {
    res.redirect('/login');
  };
});