Hi guys!

I have a problem, will explain how to reproduce the problem:

1- login into my page (sesion variables set as $_SESSION['logged'] = true and $_SESSION['id'] = 123

2-then inside the main menu I click logout option, code like this

function logout()
{
    session_start();
    $_SESSION['id'] = null;
    $_SESSION['logged'] = null;

    unset($_SESSION);

    session_destroy();

    require_once('Views/SessionExpiredView.php');   
}

3- In the session expired view I display a link the login page, there session is null

4- I click back on the browser and click ok to resend information

5- session becomes again $_SESSION['logged'] = true and $_SESSION['id'] = 123 and I'm loggued again and able to see all the information related to the id 123

This is a security issue and I don't know what is happening!!!

any suggestion will be deeply appreciated.

Alejandra