Take the 2-minute tour ×

A colleague is pushing clearing the client browser's history (i.e. back-button) when they logout of our web application. Is this considered a good practice? It strikes me as a really intrusive. If only conditionally, what conditions need to be in place for this practice to be useful?

share|improve this question
This question might be a better fit for the IT Security SE site. –  Bernard Mar 28 '12 at 15:28
I'd consider a script that does this malware and install a script blocker, if not outright leave it. –  delnan Mar 28 '12 at 15:39
I think the point is moot since most browsers prevent the activity you are trying to do it is only going to be effective on out of date (IE 5 blocked this so really out of date) and maybe some niche browsers. –  Chad Mar 28 '12 at 21:04
I agree with @Chad, I'm pretty sure it is not possible to clear the browser history from script - not javascript, or an in-browser java app, not flash either. I could be wrong, though. –  qes Mar 29 '12 at 4:52
add comment

3 Answers

up vote 6 down vote accepted

Is it critical for the app's functionality? Remember that it can probably be blocked by the user disabling the script, so keep in mind that your app should still be able to handle situations where the history clearing script does NOT run.

Personally, I'd find this sort of behaviour nasty and excessively invasive and intrusive. Who do you think you are, trying to mess with my browser's history on my local machine? Don't do it.

Thinking more carefully, this might be acceptable if the web application is intended to be accessed from browsers running in "kiosk" mode, like in those computers in malls used for product promotions. I think it would be OK here because these aren't the "user's" personal comptuer, but a kiosk that random members of the public will use. But in that case, I'd think that such a requirement arose because of bad design elsewhere in the application. I am really having a hard time thinking of a valid business reason (that doesn't sound suspicious or malicious) that a web application needs to get rid of the browser history, but I'm open to suggestions...

share|improve this answer
It's not critical. It would be a quick fix for his implementation of the auth/acl. I'm sure there's a better way. –  user25791 Mar 28 '12 at 16:13
add comment

No. I've never heard of anyone doing that and I would prefer if a web app didn't mess with my browsing history. Your coworker must be using a trick like the asker in this question is using to clear the history, but it is IE only.

It sounds like the accepted best practice is to use window.location.replace to keep a page from going into history. See A, B.

share|improve this answer
add comment

Clearing the browser history when the user leaves your application seems to be a pretty good example of security through obscurity. This form is particularly invasive, as you're counteracting an expected function on the users computer.

You should not rely on this technique to secure your application. It should not mater if a malicious knows the URLs that a user visited on your application.

share|improve this answer
+1, if your app can be compromised by URL attack alone then you've probably got some other fundamental issues. –  Wyatt Barnett Mar 28 '12 at 17:58
add comment

Your Answer

