If a user presses back after logging in to a website should the authentication cookie be set to expire because the user expects to be logged out if they can see the login page or not?
2 Answers
You know they are authenticated so the decision should be a balance of how your users expect/want your app to work and what are the business requirements for it?
There's no right or wrong answer really, if the user backs to the login page and you detect that they already have a authentication token you could, perhaps, ask the question "did you intend to log out?" With a button allowing them to do so. If you use this method I would provide a link back to the screen they were at in case the back action was in error.
-
Agreed. Must better show them the login screen and say "You're currently logged in as: John Smith. (log out). Then show a title "Login in to another account" with your login form. As oppose to automatically logging them out. Recall it takes time to enter your login information. Unless you have strong business requirements for high system security, you want to save the user time by not auto-logging them out. Apr 23, 2015 at 17:28
There are a few question on here about back buttons and I will start with the same thing: The back button does not for a part of your interface. It is under the complete control of the user and may not behave in a predictable way as far as your system is concerned.
It's probably not a good idea to instantly log the user out and make them go through the sign in process again every time they click back in the browser or even if they click "log out" (in most cases this latter should result in an "Are you sure?" dialogue) - A better solution for the log in form would be for it to react to the cookie/session data and show a message like "You're already logged in." and a link back to the logged in homepage or some other significant page.
answered Apr 23, 2015 at 16:32
