A colleague is pushing clearing the client browser's history (i.e. back-button) when they logout of our web application. Is this considered a good practice? It strikes me as a really intrusive. If only conditionally, what conditions need to be in place for this practice to be useful?
Is programmatically clearing the browser's history an accepted best practice?
security
Is it critical for the app's functionality? Remember that it can probably be blocked by the user disabling the script, so keep in mind that your app should still be able to handle situations where the history clearing script does NOT run.Personally, I'd find this sort of behaviour nasty and excessively invasive and intrusive. Who do you think you are, trying to mess with my browser's history on my local machine? Don't do it.Thinking more carefully, this might be acceptable if the web application is intended to be accessed from browsers running in kiosk mode, like in those computers in malls used for product promotions. I think it would be OK here because these aren't the user's personal comptuer, but a kiosk that random members of the public will use. But in that case, I'd think that such a requirement arose because of bad design elsewhere in the application. I am really having a hard time thinking of a valid business reason (that doesn't sound suspicious or malicious) that a web application needs to get rid of the browser history, but I'm open to suggestions...