Prevent Browser's Back Button Login After Logout in Laravel 5
Stefan Izdrail
Founder & Senior Architect · 2026-06-29
Understanding and resolving browser back button-related authentication issues can be tricky, especially with Laravel 5, even though it provides advanced security measures. In this blog post, we will discuss an efficient method to prevent users from viewing the contents of a page they no longer have access to after logging out, while maintaining a user-friendly experience. Although disabling caching may seem like a quick solution, it's not the most effective or secure way. Instead, let's explore a better approach.
The Problem and Analysis
When users log out of an application in Laravel 5, they still have access to the content of that page after clicking the browser's back button. This issue occurs because the page is cached when it is initially loaded, and Laravel's authentication process does not automatically account for it before rendering the page.
The Solution: Redirecting After Logout
To address this problem, we recommend redirecting users to a specific page after logging out. The following code snippet shows an improved version of your original logout route (replace `redirect_url` with the desired redirection URL):
Route::get('logout', array('uses' => 'LoginController@logout'));
public function logout() {
Auth::logout(); // logout user
Session::flush();
Redirect::to($redirect_url); // redirect after logout
}
Adding a CSRF Token to the Redirection URL
However, a minor security issue can arise if attackers intercept and modify your redirection URL. To address this concern, we should add a CSRF token in the redirection URL. A CSRF (Cross-site request forgery) token helps prevent unauthorized users from submitting forms or performing actions that would require authentication.
Route::get('logout', array('uses' => 'LoginController@logout'));
public function logout() {
Auth::logout(); // logout user
Session::flush();
$token = csrf_token(); // generate a CSRF token
Redirect::to(route('redirect_url', ['token' => $token])); // redirect with token and redirection url
}
The Final Step: Verifying the Token on the Target Page
Now, when a user clicks the back button, they will be redirected to the target page, which will have a route that accepts the CSRF token. This will check if the provided token matches the one generated during the logout process. If it does not match or is invalid, the browser can show an error message instead of displaying the content.
Route::get('redirect_url/{token}', function ($token) {
// validate and check if token matches the one generated during logout
if (!auth()->verifyToken($token)) {
return response('Invalid CSRF Token', 403); // show an error message for invalid token
} else {
Redirect::back(); // redirect back to login page
}
});
Conclusion
By following the steps outlined in this blog post, you can effectively prevent users from accessing the content of a page after logging out. This approach ensures better security and user experience while addressing the browser's back button-related issues. Remember to always keep your Laravel application up to date with the latest security patches and updates for enhanced protection.