tpac: after logout, patrons can view account information by using the back button

[Kathy Lussier]

Evergreen version 2.2 RC1

After logging out of tpac, if a patron uses their back button, they can view their account details. If the user then performs an aaction or hits reload, their account information is no longer available. Discussion in IRC suggested that a no-cache header might fix this.

[Thomas Berezansky (tsbere)]

How about this?

http://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/tsbere/tpac_myopac_no_cache

[Bill Erickson (berick)]

I've been meaning to open a ticket for this. Thanks, Kathy.

+1 to Thomas' solution.

A short term workaround would be to add something like this to the *:443 VirtulHost section of the eg.conf Apache config.

     <LocationMatch /eg/opac>
         Header set Cache-Control "no-cache, no-store, must-revalidate"
         Header set Pragma "no-cache"
         Header set Expires "-1"
     </LocationMatch>

Thomas' approach is a better long term solution, though, since it only takes effect when a user is logged in (and it will Just Work for the kpac as well).

[Michael Peters (mrpeters)]

Thomas's solution works just as advertised.

http://git.evergreen-ils.org/?p=working/Evergreen.git;a=commitdiff;h=22b453666bc06750735424f21c38cdcb76ae34cf

tpac_myopac_no_cache_signoff

[Dan Scott (denials)]

Tested, works, pushed to master and rel_2_2.

Thanks Thomas!

[Dan Scott (denials)]

And thanks, Michael, for testing & signing-off as well!