Improper Session Termination

[vishal05]

After Logout into wordpress back-end when we press “Back” button of the browser an authenticated page got displayed without entering any valid credentials.

[ayeshrajans]

Shameless self-plug to a plugin I have put together that helps mitigate this with Clear-Site-Data HTTP header: ​https://wordpress.org/plugins/clear-logout/

[khag7]

The Clear-Site-Data header clears browsing data (cookies, storage, cache) associated with the requesting website. It allows web developers to have more control over the data stored locally by a browser for their origins.

​https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data

The function wp_logout in pluggable.php should send the header:

header('Clear-Site-Data:"*"');

Trac ticket: