Prevent authenticated pages appearing after logout

app/ui/routes/auth.py

@@ -910,5 +910,21 @@ def change_password_required(request: Request):
 @router.get("/logout")
 def logout(request: Request):
     request.session.clear()
-    return RedirectResponse(url="/login", status_code=303)
+
+    response = RedirectResponse(url="/login", status_code=303)
+    settings = get_settings()
+    response.delete_cookie(
+        key=settings.COOKIE_SESSION_NAME,
+        path="/",
+        secure=settings.COOKIE_SECURE,
+        httponly=True,
+        samesite=settings.COOKIE_SAMESITE,
+    )
+    response.headers["Cache-Control"] = (
+        "no-store, no-cache, must-revalidate, private, max-age=0"
+    )
+    response.headers["Pragma"] = "no-cache"
+    response.headers["Expires"] = "0"
+    response.headers["Clear-Site-Data"] = '"cache"'
+    return response
 

app/ui/templates/base/layout.html

@@ -748,5 +748,26 @@
 })();
 </script>
 
+{% if full_auth %}
+<script>
+(function () {
+  "use strict";
+
+  window.addEventListener("pageshow", function (event) {
+    var navigationEntries = window.performance && performance.getEntriesByType
+      ? performance.getEntriesByType("navigation")
+      : [];
+    var navigation = navigationEntries && navigationEntries.length
+      ? navigationEntries[0]
+      : null;
+
+    if (event.persisted || (navigation && navigation.type === "back_forward")) {
+      window.location.reload();
+    }
+  });
+})();
+</script>
+{% endif %}
+
 </body>
 </html>