Is there any way to check for user login and send him to login?

Question

I have written a plugin for my own site where I have an issue like "after user login to the site if he logout then again if he clicks on browser back button then the previous page showing again instead of login page". for this issue I fixed it by using below js code:

history.pushState(null, null, document.URL);
window.addEventListener('popstate', function () {
 history.pushState(null, null, document.URL);
});

The browser back button issue fixed but after adding the above js code I got new issue i.e. browser back button totally getting disabled, what if user wants to use browser back button to navigate through the site web pages?

IS there any hook that I can write in theme functions.php file? so that I can fix this issue if user clicks on browser back button after logout? can anyone please tell me how to fix it?

I tried the one below but din't work either:

<script>
   window.onhashchange = function() {
       <?php if( ! is_user_logged_in()) { $this->tewa_login(); } ?>
   }
<script>

what's wrong plz can anyone tell me!

Answer 1

When a user logs out the current user session is destroyed and no new pages can be loaded for which a user must be logged in. However, when you hit the 'back' button on your browser, it typically retrieves the page from the local cache. There is no contact with the server to see if the current session is still valid.

So, what you need to do is detect whether the backspace button has been hit and in that case check the validity of the session. This means there must be a piece of javacript included in the page, because this action needs to take place at the user side. I'm not a security expert, but the common way to detect the backspace goes like this:

window.onhashchange = function() {
 .. your action ..
 }

There are some snags to this method. Now, your action must be to call back to the server. That question has been answered before here on WPSE.

Answer 2

Just some appendix to @cjbj answer. It may help you, this is why I am writing this.

WordPress "session" is actually a cookie. It starts with wordpress_logged_in

Once you log out:

Once you refresh still there will be no cookie:

So what you need to understand:

if he clicks on browser back button then the previous page showing again instead of login page".

This is not an issue, this is normal.

If you plan to alter the default, try using the JavaScript page refresh or so.