Client side risks: Preventing problems due to "accidental" exposure on the client side

Problem
A legitimate surfer might use your site and then leave the browser unattended, either at an Internet cafe or in an unsecured office situation.

Someone else could sit down at the station and use the [Back] button to look for confidential information.

Solution
The solution requires two steps:

1. For all pages that have sensitive data, use the EXPIRES macro:

   (~EXPIRES|-1~)
   

   anywhere on the page (preferably from a shared chunk).

2. At the top of all protected pages, call a shared chunk which runs the IFINACTIVEFORSEC macro, so that if someone tries to retrieve a secure page (either via [Back] or by clicking a link), and the timeout period has elapsed, the BOUNCE will occur and the person will have to log in again.