Yes I do, and my security program does that, but...

WebWitchcraft — Thu, 06 Sep 2001 14:26:41 +0000

If they redisplay the page, my security manager only checks for the same user name. If they use a different name, it would not detect that.

I actually think the proper solution is to just expire that page (as you often see happen with enrollment pages) and not allow the user to return to it. Then let the security manager do its 'normal' double-entry check if they happen to redisplay it anyway. But having the user press the back button and instantly redisplaying the enrollment page (as happens now) is just too easy and an open invitation to mischief, IMO. Does anyone have any suggestions for how to do that (expire the page, that is...)? I see this all the time, so I KNOW that's possible. Is there perhaps a way for the called PERL script (which is what receives the request and presents the page to begin with) to check and then refuse to load the page if the back-button was pressed?

Thanks again.

LancerForums — Thu, 06 Sep 2001 04:42:06 +0000

When a user registers do you store their info in a database? If so, you can check to make the same user is not already there.

Blocking the back button will kind of work, but technically a user could enter the old url themselves or even more forward to a page that allows the back button and right clicking to return to the registration portion.

Maybe you could set a cookie to know if a user has already been to that section. The problem with that is if a user disables them they won't work.

Mark