Is programmatically clearing the browser's history an accepted best practice?

Question

A colleague is pushing clearing the client browser's history (i.e. back-button) when they logout of our web application. Is this considered a good practice? It strikes me as a really intrusive. If only conditionally, what conditions need to be in place for this practice to be useful?

Answer 1

Is it critical for the app's functionality? Remember that it can probably be blocked by the user disabling the script, so keep in mind that your app should still be able to handle situations where the history clearing script does NOT run.

Personally, I'd find this sort of behaviour nasty and excessively invasive and intrusive. Who do you think you are, trying to mess with my browser's history on my local machine? Don't do it.

---

Thinking more carefully, this might be acceptable if the web application is intended to be accessed from browsers running in "kiosk" mode, like in those computers in malls used for product promotions. I think it would be OK here because these aren't the "user's" personal comptuer, but a kiosk that random members of the public will use. But in that case, I'd think that such a requirement arose because of bad design elsewhere in the application. I am really having a hard time thinking of a valid business reason (that doesn't sound suspicious or malicious) that a web application needs to get rid of the browser history, but I'm open to suggestions...

Answer 2

No. I've never heard of anyone doing that and I would prefer if a web app didn't mess with my browsing history. Your coworker must be using a trick like the asker in this question is using to clear the history, but it is IE only.

It sounds like the accepted best practice is to use window.location.replace to keep a page from going into history. See A, B.

Answer 3

Clearing the browser history when the user leaves your application seems to be a pretty good example of security through obscurity. This form is particularly invasive, as you're counteracting an expected function on the users computer.

You should not rely on this technique to secure your application. It should not mater if a malicious knows the URLs that a user visited on your application.