Improper Session Termination

[vishal05]

After Logout into wordpress back-end when we press “Back” button of the browser an authenticated page got displayed without entering any valid credentials.

[ayeshrajans]

Shameless self-plug to a plugin I have put together that helps mitigate this with Clear-Site-Data HTTP header: ​https://wordpress.org/plugins/clear-logout/

[khag7]

The Clear-Site-Data header clears browsing data (cookies, storage, cache) associated with the requesting website. It allows web developers to have more control over the data stored locally by a browser for their origins.

​https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data

The function wp_logout in pluggable.php should send the header:

header('Clear-Site-Data:"*"');

Trac ticket:

[brookedot]

I like the idea of adding this feature. Especially as browser support has grown.

I'm happy to refresh the patch to get this closer to being added to WordPress 6.4.

Looking at the current patch, I'm wondering if we should make it filterable to allow the header to be disabled. I could see that being useful in places such as intranet sites, or if it is causing some other problems.

Thoughts?